SharpImpersonation Tool Execution on Windows
Flags execution of SharpImpersonation.exe on Windows when command-line parameters indicate token impersonation activity.
- Product
- windows
- Category
- process_creation
- Author
- Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-27
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of the SharpImpersonation.exe binary by matching both the image path and the original filename. It further looks for command-line indicators associated with user, binary/shellcode fields, and techniques consistent with CreateProcessAsUserW and ImpersonateLoggedOnuser. Such tooling can be used to manipulate access tokens for remote or interactive impersonation, making process and command-line telemetry essential for detection.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: SharpImpersonation Tool Execution on Windows
id: ccef72f9-d1b6-4038-83ee-69751d748009
related:
- id: cf0c254b-22f1-4b2b-8221-e137b3c0af94
type: similar
- id: f89b08d0-77ad-4728-817b-9b16c5a69c7a
type: derived
status: test
description: This rule identifies execution of the SharpImpersonation.exe binary by matching both the image path and the original filename. It further looks for command-line indicators associated with user, binary/shellcode fields, and techniques consistent with CreateProcessAsUserW and ImpersonateLoggedOnuser. Such tooling can be used to manipulate access tokens for remote or interactive impersonation, making process and command-line telemetry essential for detection.
references:
- https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/
- https://github.com/S3cur3Th1sSh1t/SharpImpersonation
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml
author: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-27
modified: 2023-02-13
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1134.001
- attack.t1134.003
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \SharpImpersonation.exe
- OriginalFileName: SharpImpersonation.exe
selection_cli:
- CommandLine|contains|all:
- " user:"
- " binary:"
- CommandLine|contains|all:
- " user:"
- " shellcode:"
- CommandLine|contains:
- " technique:CreateProcessAsUserW"
- " technique:ImpersonateLoggedOnuser"
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1