Identifier / Programs / Windows

sftp.exe

Secure File Transfer Program. Interactive program to copy files between hosts over SSH. For non-interactive file transfers, see scp or rsync. tldr-pages

LOLBAS Execute 2 Sigma rules name it 2 ATT&CK techniques 2 documented commands 3 known copies with hashes

How sftp.exe is abused

documented by LOLBAS

Execute T1202 Indirect Command Execution

-o

Execute T1202 Indirect Command Execution

-d

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for sftp.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1202 Indirect Command Execution User privileges

Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.

sftp -o ProxyCommand="{CMD}" .

Identify

Trips 2 Sigma rules: mediumIndirect Command Execution via SFTP ProxyCommand by Swachchhanda Shrawan Poudel (Nextron Systems); mediumProgram Executed Using Proxy/Local Command Via SSH.EXE by frack113, Nasreddine Bencherchali

Execute T1202 Indirect Command Execution User privileges

Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.

sftp -D "{CMD}"

Identify

Trips no Sigma process-creation rule.

1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for sftp.exe, by Swachchhanda Shrawan Poudel, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for sftp.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumUse Of The SFTP.EXE Binary As A LOLBINNasreddine Bencherchali (Nextron Systems)

mediumIndirect Command Execution via SFTP ProxyCommandSwachchhanda Shrawan Poudel (Nextron Systems)

T1202Indirect Command Execution

T1218System Binary Proxy Execution

Is it the real sftp.exe?

file version info and known copies

Installed inC:\Windows\system32\OpenSSH\

Signed byMicrosoft Windows

ProductOpenSSH for Windows

3 known copies

8.1.0.1 · C:\Windows\system32\OpenSSH\sftp.exe · signed by Microsoft Windows

a354eb6416ab635ab8059fe07fb87488793eee30fab09429e00974dbf38f90c1

8.1.0.1 · C:\WINDOWS\system32\OpenSSH\sftp.exe · signed by Microsoft Windows

aa70945b455d361549c7483b0c25757601d83a8d75ecc6f4571a61a62752509d

7.7.2.1 · C:\Windows\system32\OpenSSH\sftp.exe · signed by Microsoft Windows

7651a9e5721c2fcee4c34a253062914ab93c7b3b415d313658b058aed4f2fde2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Connect to a remote server and enter an interactive command mode

sftp remote_user@remote_hostIdentify

Connect using an alternate port

sftp -P remote_port remote_user@remote_hostIdentify

Connect using a predefined host (in ~/.ssh/config)

sftp hostIdentify

None of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.