Sftp.exe

type: OSBinaries

sftp.exe is a Windows command-line utility that uses the Secure File Transfer Protocol (SFTP) to securely transfer files between a local machine and a remote server.

Full path

C:\Windows\System32\OpenSSH\sftp.exe

Commands

ExecuteUser T1202
Proxy execution of specified command, can be used as a defensive evasion.
```
sftp -o ProxyCommand="{CMD}" .
```
Spawns ssh.exe which in turn spawns the specified command line. See also this project’s entry for ssh.exe.
os: Windows 10, Windows 11
Execute: CMD
ExecuteUser T1202
Proxy execution of specified command, can be used as a defensive evasion.
```
sftp -D "{CMD}"
```
Spawns ssh.exe which in turn spawns the specified command line. See also this project’s entry for ssh.exe.
os: Windows 10, Windows 11
Execute: CMD

Detection

IOCsftp.exe executions with ProxyCommand on the command line
IOCsftp.exe spawning ssh.exe with ProxyCommand on the command line
Sigma https://github.com/SigmaHQ/sigma/pull/5414/files

Resources

https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/

acknowledgement: Swachchhanda Shrawan Poudel @_swachchhanda_, Nir Chako (Pentera) @C_h4ck_0