Windows Process Creation: SharPersist HackTool Execution

title: "Windows Process Creation: SharPersist HackTool Execution"
id: 3eb16fb4-548e-4f6c-9549-67e788396033
status: test
description: This rule flags execution of the SharPersist tool by matching process image names and specific command-line arguments used to install persistence. Attackers use SharPersist to deploy multiple persistence mechanisms, so correlating its execution is useful for identifying unauthorized persistence deployment activity. It relies on Windows process creation telemetry, including the executable path/name and the full command line parameters.
references:
  - https://www.mandiant.com/resources/blog/sharpersist-windows-persistence-toolkit
  - https://github.com/mandiant/SharPersist
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpersist.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-15
modified: 2023-02-04
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \SharPersist.exe
    - Product: SharPersist
  selection_cli_1:
    CommandLine|contains:
      - " -t schtask -c "
      - " -t startupfolder -c "
  selection_cli_2:
    CommandLine|contains|all:
      - " -t reg -c "
      - " -m add"
  selection_cli_3:
    CommandLine|contains|all:
      - " -t service -c "
      - " -m add"
  selection_cli_4:
    CommandLine|contains|all:
      - " -t schtask -c "
      - " -m add"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 26488ad0-f9fd-4536-876f-52fea846a2e4
    type: derived