Create proc_creation_win_winscp_command_open_ftp.yml

Author: nasbench

…on/proc_creation_win_winscp_susp_cli.yml …creation_win_winscp_command_open_ftp.ymlrules-threat-hunting/windows/process_creation/proc_creation_win_winscp_susp_cli.yml renamed to rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_command_open_ftp.yml rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_susp_cli.yml renamed to rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_command_open_ftp.yml

@@ -1,11 +1,11 @@
-title: Winscp CLI Command To Open FTP Connexion
+title: FTP Connection Open Attempt Via Winscp CLI
 id: c1477deb-37cf-4439-9ffb-44499acb89d0
 status: experimental
-description: Use Winscp command cli option to open a connexion
+description: Detects the execution of Winscp with the "-command" and the "open" flags in order to open an FTP connection. Akira ransomware was seen using this technique in order to exfiltrate data.
 references:
     - https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
 author: frack113
-date: 2024-07-30
+date: 2025-10-12
 tags:
     - attack.exfiltration
     - attack.t1048