Indirect Command Execution via SFTP ProxyCommand

Status: experimental
Severity: medium
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter. Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.

Known false positives

Legitimate use of SFTP with proxy commands for administration or networking tasks

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1202` Indirect Command Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Indirect Command Execution via SFTP ProxyCommand
id: 762bb580-79b4-40f4-8b9e-9349ce1710f4
status: experimental
description: |
    Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.
    Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Sftp/
    - https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-27
tags:
    - attack.stealth
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\sftp.exe'
        CommandLine|contains: 'ProxyCommand='
    condition: selection
falsepositives:
    - Legitimate use of SFTP with proxy commands for administration or networking tasks
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_sftp_indirect_cmd_execution/info.yml

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\sftp.exe'
    CommandLine|contains: 'ProxyCommand='

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`ProxyCommand=` corpus 2 (sigma 2)	`field:"CommandLine" kind:match value:"ProxyCommand="`
`Image`	ends_with	`\sftp.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\sftp.exe"`