Anvilogic critical experimental other

WinSCP Execution [snowflake-crowdstrikefdr_process]

WinSCP is an open source free SFTP client, FTP client, WebDAV client, S3 client and SCP client for Windows. Its main function is file transfer between a local and a remote computer. Adversaries have been known to use winscp in order to exfiltrate data. - Threat Actor Association: BlueNoroff, Lazarus, Stonefly, Wizard Spider -- Software Association: Akira, Bazar, Conti, LockBit, Play, Rhysida

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and (process_path ilike '%winscp.exe' or regexp_like(process, '.*[^a-z]\\\/(command
| script)[^a-z].*', 'i'))

Field Validations

Loading…

Comments (0)

Loading comments...