Indirect Command Execution via SFTP ProxyCommand

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter. Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.