PSFTP

Validate PSFTP behaviors under the Secure Sandbox.

Objectives

• Enforce network controls for SFTP connections.
• Verify file system isolation during transfer.

Preconditions

• Windows target with Turbo Launcher and Secure Sandbox.
• PSFTP installed.

Controls Under Test

• runtime.networking.egressDefaultAction, proxy enforcement.
• runtime.files.contexts.

Test Scenarios

ID	Canonical ID	Scenario	Procedure	Expected Outcome
SCEN-TOOL-PSFTP-01	NET-EGRESS-01	Transfer to Disallowed IP	Run psftp user@<IP>; put file.	Connection fails (timeout or proxy deny).
SCEN-TOOL-PSFTP-02	NET-EGRESS-10	Transfer via Designated Proxy	Connect to allowlisted host via designated proxy.	Connection succeeds only when proxy identity/pinning is valid; traffic traverses the proxy; on mismatch, TLS handshake fails. Audit includes proxyEnforced: true and reason when denied.
SCEN-TOOL-PSFTP-03	HARD-FILES-01	Download to Host	Get file from remote to C:\.	Write restricted to overlay/context.

Evidence Requirements

• network events: protocol, destination, action.
• fileOp events: write attempts.