huntrule

SharpUp PrivEsc Tool Execution on Windows via Process Creation

Flags SharpUp.exe execution on Windows when command line indicators reference common privilege-escalation targets.

FreeUnreviewedSigmacriticalv1
title: SharpUp PrivEsc Tool Execution on Windows via Process Creation
id: 5b1f4e1c-b622-4e39-91c7-9cc97cc0a3ec
status: test
description: This rule identifies execution of SharpUp by matching process creation events for SharpUp.exe and verifying that the command line and description reference multiple privilege-escalation checks. Attackers use SharpUp to enumerate hijackable configurations and weaknesses (such as service paths, DLL hijacking, modifiable binaries, scheduled tasks, and credential-related targets) to escalate local privileges. Telemetry required is Windows process creation data, including image filename, description, and command line content.
references:
  - https://github.com/GhostPack/SharpUp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpup.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-20
modified: 2023-02-13
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.discovery
  - attack.execution
  - attack.stealth
  - attack.t1615
  - attack.t1569.002
  - attack.t1574.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \SharpUp.exe
    - Description: SharpUp
    - CommandLine|contains:
        - HijackablePaths
        - UnquotedServicePath
        - ProcessDLLHijack
        - ModifiableServiceBinaries
        - ModifiableScheduledTask
        - DomainGPPPassword
        - CachedGPPPassword
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: c484e533-ee16-4a93-b6ac-f0ea4868b2f1
    type: derived

What it detects

This rule identifies execution of SharpUp by matching process creation events for SharpUp.exe and verifying that the command line and description reference multiple privilege-escalation checks. Attackers use SharpUp to enumerate hijackable configurations and weaknesses (such as service paths, DLL hijacking, modifiable binaries, scheduled tasks, and credential-related targets) to escalate local privileges. Telemetry required is Windows process creation data, including image filename, description, and command line content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.