scp.exe

# No OriginalFilename in any observed build: match on the image instead
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\scp.exe'
  condition: selection

| tstats summariesonly=false count from datamodel=Endpoint.Processes
    where Processes.process_name="scp.exe"
    by Processes.dest Processes.process_name Processes.process_path Processes.process
| rename Processes.* as *

DeviceProcessEvents
| where FileName =~ "scp.exe"

process where event.type == "start" and process.name : "scp.exe"

String(Image || '').toLowerCase().endsWith("\\scp.exe")