scp.exe

type: OSBinaries

Used for uploading or downloading files over SSH.

Full path

C:\Windows\System32\OpenSSH\scp.exe

Commands

ExecuteUser T1202
Proxy execution of specified command, can be used as a defensive evasion.
```
scp.exe -o ProxyCommand="{CMD}" . localhost:.
```
Spawns specified command from scp.exe -> ssh.exe, even if no SSH server is running on localhost (or any other address specified).
os: Windows 10, Windows 11
Execute: CMD
ExecuteUser T1202
Proxy execution of specified command, can be used as a defensive evasion.
```
scp.exe -S "{CMD}" . localhost:.
```
Spawns specified command from scp.exe -> ssh.exe, even if no SSH server is running on localhost (or any other address specified).
os: Windows 10, Windows 11
Execute: CMD

Detection

IOC`scp.exe` executions referencing `ProxyCommand`.

Resources

https://gtfobins.org/gtfobins/scp/

acknowledgement: BinFault @binfault, Nir Chako (Pentera) @C_h4ck_0