SharpImpersonation Tool Execution on Windows

Flags execution of SharpImpersonation.exe on Windows when command-line parameters indicate token impersonation activity.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-12-27
Updated
2026-07-31
title: SharpImpersonation Tool Execution on Windows
id: ccef72f9-d1b6-4038-83ee-69751d748009
related:
  - id: cf0c254b-22f1-4b2b-8221-e137b3c0af94
    type: similar
  - id: f89b08d0-77ad-4728-817b-9b16c5a69c7a
    type: derived
status: test
description: This rule identifies execution of the SharpImpersonation.exe binary by matching both the image path and the original filename. It further looks for command-line indicators associated with user, binary/shellcode fields, and techniques consistent with CreateProcessAsUserW and ImpersonateLoggedOnuser. Such tooling can be used to manipulate access tokens for remote or interactive impersonation, making process and command-line telemetry essential for detection.
references:
  - https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/
  - https://github.com/S3cur3Th1sSh1t/SharpImpersonation
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml
author: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-27
modified: 2023-02-13
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.001
  - attack.t1134.003
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \SharpImpersonation.exe
    - OriginalFileName: SharpImpersonation.exe
  selection_cli:
    - CommandLine|contains|all:
        - " user:"
        - " binary:"
    - CommandLine|contains|all:
        - " user:"
        - " shellcode:"
    - CommandLine|contains:
        - " technique:CreateProcessAsUserW"
        - " technique:ImpersonateLoggedOnuser"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1