mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-01-03 18:42:01 +01:00
860246fe18
c:\windows\system32\openssh\sftp.exe with the -D flag, is able to execute another exe file
21 lines
609 B
Plaintext
21 lines
609 B
Plaintext
---
|
|
Name: sftp.exe
|
|
Description: SSH File Transfer Protocol
|
|
Author: Nir Chako
|
|
Created: 2022-11-06
|
|
Commands:
|
|
- Command: "sftp -D c:\windows\system32\notepad.exe"
|
|
Description: Execute notepad.exe with sftp.exe as parent process
|
|
Usecase: Use sftp.exe as a proxy binary to evade defensive counter-measures
|
|
Category: Execute
|
|
Privileges: User
|
|
MitreID: T1202
|
|
OperatingSystem: Windows 10, Windows 11
|
|
Full_Path:
|
|
- Path: c:\windows\system32\OpenSSH\sftp.exe
|
|
Detection:
|
|
- IOC: sftp.exe spawning unexpected processes
|
|
Acknowledgement:
|
|
- Person: 'Nir Chako (Pentera)'
|
|
Handle: '@C_h4ck_0'
|