Library / LOLBin
sftp.exe
OriginalFilename
None. No observed build carries an OriginalFilename, so sensors log -.
No OriginalFilename
Gotchas
- No OriginalFilename in any observed build, so Sysmon logs
-and OriginalFileName rules can't match it. Anchor on the image path, hash or signer instead.
Query snippets
# No OriginalFilename in any observed build: match on the image instead
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\sftp.exe'
condition: selectionprocess_creation logsource. Sigma string matching is case-insensitive.
| tstats summariesonly=false count from datamodel=Endpoint.Processes
where Processes.process_name="sftp.exe"
by Processes.dest Processes.process_name Processes.process_path Processes.process
| rename Processes.* as *Endpoint.Processes data model. On raw Sysmon events the field is OriginalFileName.
DeviceProcessEvents
| where FileName =~ "sftp.exe"Microsoft Defender XDR advanced hunting. in~ and =~ are case-insensitive.
process where event.type == "start" and process.name : "sftp.exe"ECS process.pe.original_file_name is a keyword field: in~ is case-insensitive, Kibana KQL is not.
String(Image || '').toLowerCase().endsWith("\\sftp.exe")Filter expression (JavaScript) for events carrying Sysmon's OriginalFileName field.
Values across builds
| OriginalFilename | Builds | Arch | File version | Windows releases | Source | Sysmon |
|---|---|---|---|---|---|---|
| none | 8 | x64 | 7.6.0.0 → 9.5.6.4 | Win10 1803 → Win11 26H1 (15) | Host scan, Winbindex |
All 8 parsed builds
| SHA256 | Version | Arch | OriginalFilename | Windows releases | Signature | Source | Sysmon |
|---|---|---|---|---|---|---|---|
| d3f093040163… | 9.5.6.4 | x64 | none | Win11 24H2, Win11 26H1 | Unsigned | Host scan, Winbindex | |
| d0790736a201… | 9.5.5.3 | x64 | none | Win10 1809 … Win11 23H2 (3) | Unsigned | Winbindex | |
| 62ea766d92eb… | 9.5.5.1 | x64 | none | Win10 1809 … Win11 25H2 (4) | Signed (Catalog file) | Winbindex | |
| 7f9499c49e53… | 9.5.4.1 | x64 | none | Win10 1809 … Win11 24H2 (6) | Unsigned | Winbindex | |
| 9974b45844c8… | 9.5.2.1 | x64 | none | Win10 1809 … Win11 24H2 (6) | Unsigned | Winbindex | |
| a354eb6416ab… | 8.1.0.1 | x64 | none | Win10 2004 … Win10 22H2 (4) | Unsigned | Winbindex | |
| 7651a9e5721c… | 7.7.2.1 | x64 | none | Win10 1809 … Win10 21H1 (6) | Signed (Catalog file) | Winbindex | |
| d38299b410e6… | 7.6.0.0 | x64 | none | Win10 1803 | Unsigned | Winbindex |
Winbindex builds link to the Microsoft symbol server copy that was hashed and parsed.