detection.wiki

Detection rules › Sigma

Indirect Command Execution via SFTP ProxyCommand

Status
experimental
Severity
medium
Log source
product windows, category process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter. Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.

MITRE ATT&CK coverage

TacticTechniques
StealthT1202 Indirect Command Execution

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Indirect Command Execution via SFTP ProxyCommand
id: 762bb580-79b4-40f4-8b9e-9349ce1710f4
status: experimental
description: |
    Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.
    Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Sftp/
    - https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-27
tags:
    - attack.stealth
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\sftp.exe'
        CommandLine|contains: 'ProxyCommand='
    condition: selection
falsepositives:
    - Legitimate use of SFTP with proxy commands for administration or networking tasks
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_sftp_indirect_cmd_execution/info.yml

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    Image|endswith: '\sftp.exe'
    CommandLine|contains: 'ProxyCommand='

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • ProxyCommand= corpus 2 (sigma 2)
Imageends_with
  • \sftp.exe corpus 2 (sigma 2)