SharpImpersonation Tool Execution on Windows via Process Creation

title: SharpImpersonation Tool Execution on Windows via Process Creation
id: ccef72f9-d1b6-4038-83ee-69751d748009
related:
  - id: cf0c254b-22f1-4b2b-8221-e137b3c0af94
    type: similar
  - id: f89b08d0-77ad-4728-817b-9b16c5a69c7a
    type: derived
status: test
description: This rule identifies process creation events for SharpImpersonation by matching the SharpImpersonation.exe executable name and associated command-line parameters. SharpImpersonation can be used to manipulate Windows tokens, enabling remote token operations (such as PsExec/WmiExec) or interactive impersonation. The detection relies on Windows process creation telemetry, including Image/OriginalFileName and CommandLine content that includes user, binary/shellcode fields, and techniques like CreateProcessAsUserW and ImpersonateLoggedOnuser.
references:
  - https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/
  - https://github.com/S3cur3Th1sSh1t/SharpImpersonation
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml
author: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-27
modified: 2023-02-13
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.001
  - attack.t1134.003
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \SharpImpersonation.exe
    - OriginalFileName: SharpImpersonation.exe
  selection_cli:
    - CommandLine|contains|all:
        - " user:"
        - " binary:"
    - CommandLine|contains|all:
        - " user:"
        - " shellcode:"
    - CommandLine|contains:
        - " technique:CreateProcessAsUserW"
        - " technique:ImpersonateLoggedOnuser"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1