SharpDPAPI Tool Execution via Command-Line and PE Metadata on Windows

Flags SharpDPAPI executions on Windows by combining SharpDPAPI PE metadata with distinctive DPAPI-related CommandLine arguments.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2024-06-26
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1134.001Token Impersonation/Theft
- T1134.003Make and Impersonate Token
Defense Evasion
- T1134.001Token Impersonation/Theft
- T1134.003Make and Impersonate Token
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of SharpDPAPI.exe by matching the process image path or PE metadata (OriginalFileName) and corroborating the command line with SharpDPAPI-specific arguments and option patterns. Attackers may use SharpDPAPI to interact with DPAPI-related secrets and encryption material as part of credential and privilege escalation activity. Telemetry relies on Windows process creation events including the executable image name and full command line, plus PE metadata fields when available.

Reporting behind it

Related detections9 linkedT1134.001 — drag to rearrange

SharpImpersonation Tool Execution on Windows

Windows Process Creation: Impersonate.exe HackTool Execution

Malicious Potato Family Privilege Escalation Tool Execution (via process_creation)

Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)

Malicious Named Pipe kesknq for Token Impersonation (via pipe_created)

Windows Security: Detect NoFilter Tool Activity via RonPolicy Filtering Policy Indicators

Windows Security 4624 LogonType 9 Impersonation via Negotiate (Advapi) Token Abuse Indicator

Windows: Detect Named Pipe Creation with Koh Default Names

Windows getsystem via Meterpreter/Cobalt Strike when services.exe starts a likely privilege escalation command

SharpDPAPI Tool Execution via Command-Line and PE Metadata on Windows

Pivot detection · T1134.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

sharpdpapi-tool-execution-on-windows-via-process-command-line-and-pe-metadata-c7d33b50

title: SharpDPAPI Tool Execution via Command-Line and PE Metadata on Windows
id: b9dd14f4-70db-4f60-a552-8180517e128c
status: test
description: This rule identifies execution of SharpDPAPI.exe by matching the process image path or PE metadata (OriginalFileName) and corroborating the command line with SharpDPAPI-specific arguments and option patterns. Attackers may use SharpDPAPI to interact with DPAPI-related secrets and encryption material as part of credential and privilege escalation activity. Telemetry relies on Windows process creation events including the executable image name and full command line, plus PE metadata fields when available.
references:
  - https://github.com/GhostPack/SharpDPAPI
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_dpapi_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-26
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.001
  - attack.t1134.003
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \SharpDPAPI.exe
    - OriginalFileName: SharpDPAPI.exe
  selection_other_cli:
    CommandLine|contains:
      - " backupkey "
      - " blob "
      - " certificates "
      - " credentials "
      - " keepass "
      - " masterkeys "
      - " rdg "
      - " vaults "
  selection_other_options_guid:
    CommandLine|contains|all:
      - " {"
      - "}:"
  selection_other_options_flags:
    CommandLine|contains:
      - " /file:"
      - " /machine"
      - " /mkfile:"
      - " /password:"
      - " /pvk:"
      - " /server:"
      - " /target:"
      - " /unprotect"
  condition: selection_img or (selection_other_cli and 1 of selection_other_options_*)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c7d33b50-f690-4b51-8cfb-0fb912a31e57
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL