StealC WinSCP Session Credential Theft via Registry or INI File
This rule detects when a process other than the legitimate WinSCP application attempts to access WinSCP saved session credentials. This access can occur either by querying the registry key HKCU\Software\Martin Prikryl\WinSCP 2\Sessions or by reading the portable configuration file 'WinSCP.ini'. This activity is suspicious as it indicates an attempt by an unauthorized process to retrieve sensitive connection information, potentially for credential access or lateral movement.
Microsoft Sentinel (KQL)
