WinSCP Execution From Non-Standard Directory
This rule detects the execution of WinSCP from any directory other than its standard installation path, 'C:\Program Files (x86)\WinSCP\'. This behavior can indicate the use of a portable version of WinSCP, which might be employed by adversaries for data exfiltration or other malicious activities to avoid detection by standard software inventory or whitelisting solutions. The rule specifically looks for process creation events where the image name ends with 'WinSCP.exe' or the original filename is 'winscp.exe', and then filters out executions originating from the legitimate installation directory.
Sigma
