Windows: SharpUp (SharpUp.exe) Local Privilege Escalation Tool Execution
Flags SharpUp.exe execution on Windows when command line indicators reference common privilege-escalation targets.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-20
- Updated
- 2026-07-31
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the executable is SharpUp.exe and the command-line and description indicate the SharpUp privilege-escalation checks are being run. Attackers may use SharpUp to discover and abuse misconfigurations such as hijackable paths, unquoted service paths, DLL hijacking, modifiable service binaries, scheduled task abuse, and exposed GPP passwords to gain higher privileges. It relies on Windows process creation telemetry, including the image path, process description, and command-line content.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: SharpUp (SharpUp.exe) Local Privilege Escalation Tool Execution"
id: 5b1f4e1c-b622-4e39-91c7-9cc97cc0a3ec
status: test
description: This rule flags process creation events where the executable is SharpUp.exe and the command-line and description indicate the SharpUp privilege-escalation checks are being run. Attackers may use SharpUp to discover and abuse misconfigurations such as hijackable paths, unquoted service paths, DLL hijacking, modifiable service binaries, scheduled task abuse, and exposed GPP passwords to gain higher privileges. It relies on Windows process creation telemetry, including the image path, process description, and command-line content.
references:
- https://github.com/GhostPack/SharpUp
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpup.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-20
modified: 2023-02-13
tags:
- attack.persistence
- attack.privilege-escalation
- attack.discovery
- attack.execution
- attack.stealth
- attack.t1615
- attack.t1569.002
- attack.t1574.005
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \SharpUp.exe
- Description: SharpUp
- CommandLine|contains:
- HijackablePaths
- UnquotedServicePath
- ProcessDLLHijack
- ModifiableServiceBinaries
- ModifiableScheduledTask
- DomainGPPPassword
- CachedGPPPassword
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: c484e533-ee16-4a93-b6ac-f0ea4868b2f1
type: derived