.. /scp.exe
Star

Used for uploading or downloading files over SSH.

Paths:

C:\Windows\System32\OpenSSH\scp.exe

Resources:

https://gtfobins.org/gtfobins/scp/

Acknowledgements:

BinFault (@binfault)
Nir Chako (Pentera) (@C_h4ck_0)

Detections:

IOC: scp.exe executions referencing ProxyCommand.

Execute

Spawns specified command from scp.exe -> ssh.exe, even if no SSH server is running on localhost (or any other address specified).
```
scp.exe -o ProxyCommand="{CMD}" . localhost:.
```
Use case
Proxy execution of specified command, can be used as a defensive evasion.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1202
Tags
Execute: CMD
Spawns specified command from scp.exe -> ssh.exe, even if no SSH server is running on localhost (or any other address specified).
```
scp.exe -S "{CMD}" . localhost:.
```
Use case
Proxy execution of specified command, can be used as a defensive evasion.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1202
Tags
Execute: CMD