{"id":"26488ad0-f9fd-4536-876f-52fea846a2e4","title":"HackTool - SharPersist Execution","description":"Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-15","modified":"2023-02-04","tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053"],"technique_ids":["T1053"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.mandiant.com/resources/blog/sharpersist-windows-persistence-toolkit","https://github.com/mandiant/SharPersist"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_sharpersist.yml","source_sha256":"67e974eda4c7a7440f384a5ea27f6c6aec782710b12369bcdd09a6825b351b11","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharpersist.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - SharPersist Execution\nid: 26488ad0-f9fd-4536-876f-52fea846a2e4\nstatus: test\ndescription: Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms\nreferences:\n    - https://www.mandiant.com/resources/blog/sharpersist-windows-persistence-toolkit\n    - https://github.com/mandiant/SharPersist\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-09-15\nmodified: 2023-02-04\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.persistence\n    - attack.t1053\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\SharPersist.exe'\n        - Product: 'SharPersist'\n    selection_cli_1:\n        CommandLine|contains:\n            - ' -t schtask -c '\n            - ' -t startupfolder -c '\n    selection_cli_2:\n        CommandLine|contains|all:\n            - ' -t reg -c '\n            - ' -m add'\n    selection_cli_3:\n        CommandLine|contains|all:\n            - ' -t service -c '\n            - ' -m add'\n    selection_cli_4:\n        CommandLine|contains|all:\n            - ' -t schtask -c '\n            - ' -m add'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053","id":"T1053","name":"Scheduled Task/Job","page":"techniques/enterprise/T1053/"}],"data_path":"data/detection-rules/26488ad0-f9fd-4536-876f-52fea846a2e4.json","kind":"sigma"}