huntrule

SharpDPAPI Tool Execution via Command-Line and PE Metadata on Windows

Flags SharpDPAPI executions on Windows by combining SharpDPAPI PE metadata with distinctive DPAPI-related CommandLine arguments.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2024-06-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies execution of SharpDPAPI.exe by matching the process image path or PE metadata (OriginalFileName) and corroborating the command line with SharpDPAPI-specific arguments and option patterns. Attackers may use SharpDPAPI to interact with DPAPI-related secrets and encryption material as part of credential and privilege escalation activity. Telemetry relies on Windows process creation events including the executable image name and full command line, plus PE metadata fields when available.

Reporting behind it

Related detections9 linkedT1134.001 — drag to rearrange
SharpImpersonation Tool Execution on Windows
Windows Process Creation: Impersonate.exe HackTool Execution
Suspicious Command Shell Spawned by lmadmin License Manager via process_creation
Suspicious Potato Privilege Escalation Tool Execution via process_creation
Suspicious W32TIME Named Pipe Activity Linked to RPC Privilege Escalation (via pipe_created)
Suspicious Access To Chrome Elevation Service COM Object via Katz Stealer
Malicious Potato Family Privilege Escalation Tool Execution (via process_creation)
Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)
Malicious Named Pipe kesknq for Token Impersonation (via pipe_created)
SharpDPAPI Tool Execution via Command-Line and PE Metadata on Windows
Pivot detection · T1134.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.