WinSCP CLI FTP/SFTP Connection Attempt

SigmaHQ Detections@sigmaHQ

•updated Oct 20, 2025•1•0•69

Detects the execution of WinSCP with the "-command" and "open" flags to establish an FTP or SFTP connection. This technique has been observed in use by the Akira ransomware group for data exfiltration.