.. /Sftp.exe
Star

sftp.exe is a Windows command-line utility that uses the Secure File Transfer Protocol (SFTP) to securely transfer files between a local machine and a remote server.

Paths:

C:\Windows\System32\OpenSSH\sftp.exe

Resources:

https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/

Acknowledgements:

Swachchhanda Shrawan Poudel (@_swachchhanda_)

Detections:

IOC: sftp.exe executions with ProxyCommand on the command line
IOC: sftp.exe spawning ssh.exe with ProxyCommand on the command line
Sigma: https://github.com/SigmaHQ/sigma/pull/5414/files

Execute

Spawns ssh.exe which in turn spawns the specified command line. See also this project's entry for ssh.exe.
```
sftp -o ProxyCommand="{CMD}" .
```
Use case
Proxy execution of specified command, can be used as a defensive evasion.

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1202
Tags
Execute: CMD