{"id":"f89b08d0-77ad-4728-817b-9b16c5a69c7a","title":"HackTool - SharpImpersonation Execution","description":"Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively","author":"Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-27","modified":"2023-02-13","tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.003"],"technique_ids":["T1134.001","T1134.003"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/","https://github.com/S3cur3Th1sSh1t/SharpImpersonation"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml","source_sha256":"da284bc1c676078d0bc4b774fbfe5cd169fa739560017d67de87559f12a76166","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - SharpImpersonation Execution\nid: f89b08d0-77ad-4728-817b-9b16c5a69c7a\nrelated:\n    - id: cf0c254b-22f1-4b2b-8221-e137b3c0af94\n      type: similar\nstatus: test\ndescription: Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively\nreferences:\n    - https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/\n    - https://github.com/S3cur3Th1sSh1t/SharpImpersonation\nauthor: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-27\nmodified: 2023-02-13\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1134.001\n    - attack.t1134.003\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_img:\n        - Image|endswith: '\\SharpImpersonation.exe'\n        - OriginalFileName: 'SharpImpersonation.exe'\n    selection_cli:\n        - CommandLine|contains|all:\n              - ' user:'\n              - ' binary:'\n        - CommandLine|contains|all:\n              - ' user:'\n              - ' shellcode:'\n        - CommandLine|contains:\n              - ' technique:CreateProcessAsUserW'\n              - ' technique:ImpersonateLoggedOnuser'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1134.001","id":"T1134.001","name":"Token Impersonation/Theft","page":"techniques/enterprise/T1134.001/"},{"key":"enterprise/T1134.003","id":"T1134.003","name":"Make and Impersonate Token","page":"techniques/enterprise/T1134.003/"}],"data_path":"data/detection-rules/f89b08d0-77ad-4728-817b-9b16c5a69c7a.json","kind":"sigma"}