{"id":"7a4d9232-92fc-404d-8ce1-4c92e7caf539","title":"HackTool - Stracciatella Execution","description":"Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.","author":"pH-T (Nextron Systems)","status":"test","level":"high","date":"2023-04-17","modified":"2024-11-23","tags":["attack.execution","attack.defense-impairment","attack.t1059","attack.t1685"],"technique_ids":["T1059","T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://github.com/mgeeky/Stracciatella"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml","source_sha256":"4e695fa2e70993978daf43138a47e5e01e880b5dc5c1fd4a54e3fa3383db67dc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Stracciatella Execution\nid: 7a4d9232-92fc-404d-8ce1-4c92e7caf539\nstatus: test\ndescription: Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.\nreferences:\n    - https://github.com/mgeeky/Stracciatella\nauthor: pH-T (Nextron Systems)\ndate: 2023-04-17\nmodified: 2024-11-23\ntags:\n    - attack.execution\n    - attack.defense-impairment\n    - attack.t1059\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\Stracciatella.exe'\n        - OriginalFileName: 'Stracciatella.exe'\n        - Description: 'Stracciatella'\n        - Hashes|contains:\n              - 'SHA256=9d25e61ec1527e2a69d7c2a4e3fe2fe15890710c198a66a9f25d99fdf6c7b956'\n              - 'SHA256=fd16609bd9830c63b9413671678bb159b89c357d21942ddbb6b93add808d121a'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: high\n\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/7a4d9232-92fc-404d-8ce1-4c92e7caf539.json","kind":"sigma"}