Use Of The SFTP.EXE Binary As A LOLBIN

Title: Use Of The SFTP.EXE Binary As A LOLBIN
Status: test
Description:Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag
References:
  -https://github.com/LOLBAS-Project/LOLBAS/pull/264
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-10
modified:None
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\sftp.exe'
    CommandLine|contains:
      -' -D ..'
      -' -D C:\'

  condition:selection
Falsepositives:
  -Unknown
Level: medium