SharpMove.exe Execution on Windows: DCOM, WMI VBS, and Scheduled Task Actions

title: "SharpMove.exe Execution on Windows: DCOM, WMI VBS, and Scheduled Task Actions"
id: 1b729a5c-4d74-4872-beea-46fa0c252dcc
status: test
description: This rule flags execution of the SharpMove .NET utility on Windows by matching the SharpMove.exe image and command-line parameters. SharpMove can perform multiple lateral-movement-adjacent actions, including DCOM-related activity, WMI-based VBScript execution, and operations involving the task scheduler. The detection relies on Windows process-creation telemetry including the executable path/name, OriginalFileName metadata, and specific command-line switches (action= and computername=).
references:
  - https://github.com/0xthirteen/SharpMove/
  - https://pentestlab.blog/tag/sharpmove/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpmove.yml
author: Luca Di Bartolomeo (CrimpSec), Huntrule Team
date: 2024-01-29
tags:
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \SharpMove.exe
    - OriginalFileName: SharpMove.exe
  selection_cli_computer:
    CommandLine|contains: computername=
  selection_cli_actions:
    CommandLine|contains:
      - action=create
      - action=dcom
      - action=executevbs
      - action=hijackdcom
      - action=modschtask
      - action=modsvc
      - action=query
      - action=scm
      - action=startservice
      - action=taskscheduler
  condition: selection_img or all of selection_cli_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 055fb54c-a8f4-4aee-bd44-f74cf30a0d9d
    type: derived