WinSCP Execution with Outbound Network Connections for Data Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects execution of WinSCP.exe followed by network connections to standard SFTP (port 22) or SCP (port 115) ports. This rule aggregates command-line activity and network connection data to identify potential file transfer or exfiltration operations initiated by the WinSCP utility.