WinSCP Data Exfiltration via SFTP/SCP from Unexpected Process Context

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

This rule detects executions of 'winscp.exe' that are spawned by suspicious parent processes commonly associated with web servers or command interpreters (e.g., w3wp.exe, httpd.exe, powershell.exe). It also flags instances where WinSCP is invoked with command-line arguments indicative of automated scripts, custom configuration files, or remote transfer protocols (SFTP/SCP/FTP), which may indicate data staging or exfiltration activities.