SharpDPAPI Tool Execution on Windows via Process Command-Line and PE Metadata

title: SharpDPAPI Tool Execution on Windows via Process Command-Line and PE Metadata
id: b9dd14f4-70db-4f60-a552-8180517e128c
status: test
description: This rule identifies process executions of SharpDPAPI by matching the SharpDPAPI executable filename in both image path and PE metadata, and by correlating CommandLine flags commonly used with the tool. Such behavior matters because SharpDPAPI is used to interact with DPAPI-related artifacts, which can support credential and key material handling as part of privilege escalation or stealthy post-compromise activity. Telemetry relies on Windows process creation fields including Image path, OriginalFileName, and CommandLine contents.
references:
  - https://github.com/GhostPack/SharpDPAPI
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_dpapi_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-26
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.001
  - attack.t1134.003
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \SharpDPAPI.exe
    - OriginalFileName: SharpDPAPI.exe
  selection_other_cli:
    CommandLine|contains:
      - " backupkey "
      - " blob "
      - " certificates "
      - " credentials "
      - " keepass "
      - " masterkeys "
      - " rdg "
      - " vaults "
  selection_other_options_guid:
    CommandLine|contains|all:
      - " {"
      - "}:"
  selection_other_options_flags:
    CommandLine|contains:
      - " /file:"
      - " /machine"
      - " /mkfile:"
      - " /password:"
      - " /pvk:"
      - " /server:"
      - " /target:"
      - " /unprotect"
  condition: selection_img or (selection_other_cli and 1 of selection_other_options_*)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c7d33b50-f690-4b51-8cfb-0fb912a31e57
    type: derived