{"id":"38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8","title":"HKTL - SharpSuccessor Privilege Escalation Tool Execution","description":"Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.\nSuccessful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-06","modified":"","tags":["attack.privilege-escalation","attack.t1068"],"technique_ids":["T1068"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/logangoins/SharpSuccessor"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_sharpsuccessor_execution.yml","source_sha256":"6bde09bd93827197c8f69786b7e9538fc969bbaf783b6581a51dbb46f0ada8f2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharpsuccessor_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HKTL - SharpSuccessor Privilege Escalation Tool Execution\nid: 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8\nstatus: experimental\ndescription: |\n    Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.\n    Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.\nreferences:\n    - https://github.com/logangoins/SharpSuccessor\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-06-06\ntags:\n    - attack.privilege-escalation\n    - attack.t1068\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\SharpSuccessor.exe'\n        - OriginalFileName: 'SharpSuccessor.exe'\n        - CommandLine|contains: 'SharpSuccessor'\n        - CommandLine|contains|all:\n              - ' add '\n              - ' /impersonate'\n              - ' /path'\n              - ' /account'\n              - ' /name'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","page":"techniques/enterprise/T1068/"}],"data_path":"data/detection-rules/38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8.json","kind":"sigma"}