WinSCP Network Connection for Potential Data Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the WinSCP utility initiating an outbound network connection to port 22 (SFTP/SCP). This behavior is often associated with post-compromise activity where adversaries use legitimate file transfer tools to exfiltrate data to attacker-controlled infrastructure.