Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process executions of SharpView.exe, specifically when the command line includes one of many SharpView/PowerView reconnaissance cmdlets. Attackers use these capabilities to enumerate Active Directory and network-related information to plan further intrusion and privilege escalation. The detection relies on process creation telemetry, matching the executable name/path and cmdlet keywords in the process command line.

Reporting behind it

Related detections9 linkedT1069.002 — drag to rearrange

Windows Process Creation: Execution of Net.exe or Net1.exe

Suspicious Reconnaissance Spawned by Injected SearchProtocolHost via process_creation

Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe

Windows: Sysinternals ADExplorer invoked with snapshot flag to create AD database snapshot

Windows Process Creation: Sysinternals ADExplorer Snapshot Exports Active Directory Database

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools

Windows Process Creation: Renamed AdFind.exe Executions

Windows file creation for SharpHound/BloodHound collection output filenames

Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets

Pivot detection · T1069.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-sharpview-exe-recon-and-discovery-commands-execution-b2317cfa

title: "Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets"
id: 7473aeec-e499-42bb-a0ef-86cbf1bea6f7
related:
  - id: dcd74b95-3f36-4ed9-9598-0490951643aa
    type: similar
  - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d
    type: derived
status: test
description: This rule flags Windows process executions of SharpView.exe, specifically when the command line includes one of many SharpView/PowerView reconnaissance cmdlets. Attackers use these capabilities to enumerate Active Directory and network-related information to plan further intrusion and privilege escalation. The detection relies on process creation telemetry, matching the executable name/path and cmdlet keywords in the process command line.
references:
  - https://github.com/tevora-threat/SharpView/
  - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2023-02-14
tags:
  - attack.discovery
  - attack.t1049
  - attack.t1069.002
  - attack.t1482
  - attack.t1135
  - attack.t1033
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: SharpView.exe
    - Image|endswith: \SharpView.exe
    - CommandLine|contains:
        - Add-RemoteConnection
        - Convert-ADName
        - ConvertFrom-SID
        - ConvertFrom-UACValue
        - Convert-SidToName
        - Export-PowerViewCSV
        - Find-DomainObjectPropertyOutlier
        - Find-DomainProcess
        - Find-DomainShare
        - Find-DomainUserEvent
        - Find-DomainUserLocation
        - Find-ForeignGroup
        - Find-ForeignUser
        - Find-GPOComputerAdmin
        - Find-GPOLocation
        - Find-Interesting
        - Find-LocalAdminAccess
        - Find-ManagedSecurityGroups
        - Get-CachedRDPConnection
        - Get-DFSshare
        - Get-DomainComputer
        - Get-DomainController
        - Get-DomainDFSShare
        - Get-DomainDNSRecord
        - Get-DomainFileServer
        - Get-DomainForeign
        - Get-DomainGPO
        - Get-DomainGroup
        - Get-DomainGUIDMap
        - Get-DomainManagedSecurityGroup
        - Get-DomainObject
        - Get-DomainOU
        - Get-DomainPolicy
        - Get-DomainSID
        - Get-DomainSite
        - Get-DomainSPNTicket
        - Get-DomainSubnet
        - Get-DomainTrust
        - Get-DomainUserEvent
        - Get-ForestDomain
        - Get-ForestGlobalCatalog
        - Get-ForestTrust
        - Get-GptTmpl
        - Get-GroupsXML
        - Get-LastLoggedOn
        - Get-LoggedOnLocal
        - Get-NetComputer
        - Get-NetDomain
        - Get-NetFileServer
        - Get-NetForest
        - Get-NetGPO
        - Get-NetGroupMember
        - Get-NetLocalGroup
        - Get-NetLoggedon
        - Get-NetOU
        - Get-NetProcess
        - Get-NetRDPSession
        - Get-NetSession
        - Get-NetShare
        - Get-NetSite
        - Get-NetSubnet
        - Get-NetUser
        - Get-PathAcl
        - Get-PrincipalContext
        - Get-RegistryMountedDrive
        - Get-RegLoggedOn
        - Get-WMIRegCachedRDPConnection
        - Get-WMIRegLastLoggedOn
        - Get-WMIRegMountedDrive
        - Get-WMIRegProxy
        - Invoke-ACLScanner
        - Invoke-CheckLocalAdminAccess
        - Invoke-Kerberoast
        - Invoke-MapDomainTrust
        - Invoke-RevertToSelf
        - Invoke-Sharefinder
        - Invoke-UserImpersonation
        - Remove-DomainObjectAcl
        - Remove-RemoteConnection
        - Request-SPNTicket
        - Set-DomainObject
        - Test-AdminAccess
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL