Winscp rule from Akira Ransomware report

rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_command_open_ftp.yml

@@ -0,0 +1,28 @@
+title: FTP Connection Open Attempt Via Winscp CLI
+id: c1477deb-37cf-4439-9ffb-44499acb89d0
+status: experimental
+description: Detects the execution of Winscp with the "-command" and the "open" flags in order to open an FTP connection. Akira ransomware was seen using this technique in order to exfiltrate data.
+references:
+    - https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
+author: frack113
+date: 2025-10-12
+tags:
+    - attack.exfiltration
+    - attack.t1048
+    - detection.threat-hunting
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_img:
+        - Image|endswith: '\WinSCP.exe'
+        - OriginalFileName: 'winscp.exe'
+    selection_cmd:
+        CommandLine|contains|windash: '-command'
+        CommandLine|contains|all:
+            - 'open '
+            - 'ftp://' # cover ftp and sftp
+    condition: all of selection_*
+falsepositives:
+    - Unknown
+level: medium

rules-threat-hunting/windows/process_creation/proc_creation_win_winscp_portable_execution.yml

@@ -0,0 +1,25 @@
+title: Winscp Execution From Non Standard Folder
+id: 7674f8ef-7141-4cf0-a311-ee359264c64c
+status: experimental
+description: Detects the execution of Winscp from an a non standard folder. This could indicate the execution of Winscp portable.
+references:
+    - https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
+author: frack113
+date: 2025-10-12
+tags:
+    - attack.exfiltration
+    - attack.t1048
+    - detection.threat-hunting
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        - Image|endswith: '\WinSCP.exe'
+        - OriginalFileName: 'winscp.exe'
+    filter_main_location:
+        Image|startswith: 'C:\Program Files (x86)\WinSCP\'
+    condition: selection and not 1 of filter_main_*
+falsepositives:
+    - Unknown
+level: medium