Rule Info
Name
Indirect Command Execution via SFTP ProxyCommand
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.
Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.
Date
2026-04-27 00:00:00
Modified
None
Id
762bb580-79b4-40f4-8b9e-9349ce1710f4
Tags
attack.stealth attack.t1202
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR