Windows: Stracciatella.exe Process Execution Identification (SharpPick behavior)
Alerts on Windows process creation for Stracciatella.exe using PE metadata and known SHA256 hashes.
- Product
- windows
- Category
- process_creation
- Author
- pH-T (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-17
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the executable matches Stracciatella.exe by filename, PE metadata (OriginalFileName/Description), or specific SHA256 hashes. Stracciatella is used to execute a PowerShell runspace from within C# (SharpPick technique), which can help attackers execute PowerShell while attempting to impair defenses. Detection relies on Windows process creation telemetry plus image path and PE metadata fields, or hash values, as provided by the environment.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Stracciatella.exe Process Execution Identification (SharpPick behavior)"
id: 00edb33e-e8d6-49fa-96b4-9f21f3101a6d
status: test
description: This rule flags process creation events where the executable matches Stracciatella.exe by filename, PE metadata (OriginalFileName/Description), or specific SHA256 hashes. Stracciatella is used to execute a PowerShell runspace from within C# (SharpPick technique), which can help attackers execute PowerShell while attempting to impair defenses. Detection relies on Windows process creation telemetry plus image path and PE metadata fields, or hash values, as provided by the environment.
references:
- https://github.com/mgeeky/Stracciatella
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2023-04-17
modified: 2024-11-23
tags:
- attack.execution
- attack.defense-impairment
- attack.t1059
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \Stracciatella.exe
- OriginalFileName: Stracciatella.exe
- Description: Stracciatella
- Hashes|contains:
- SHA256=9d25e61ec1527e2a69d7c2a4e3fe2fe15890710c198a66a9f25d99fdf6c7b956
- SHA256=fd16609bd9830c63b9413671678bb159b89c357d21942ddbb6b93add808d121a
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 7a4d9232-92fc-404d-8ce1-4c92e7caf539
type: derived