Windows Process Creation: SharpView.exe Recon and Discovery Commands Execution

title: "Windows Process Creation: SharpView.exe Recon and Discovery Commands Execution"
id: 7473aeec-e499-42bb-a0ef-86cbf1bea6f7
related:
  - id: dcd74b95-3f36-4ed9-9598-0490951643aa
    type: similar
  - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d
    type: derived
status: test
description: This rule flags process creation events on Windows where the executable SharpView.exe is run and the command line contains one or more SharpView/PowerView-style discovery or enumeration cmdlets. Attackers commonly use these commands to gather information about Active Directory objects, trust relationships, network shares, RDP/DFS session details, and related environment configuration to support further targeting. The detection relies on Windows process creation telemetry, matching the original image name/path and specific command-line substrings.
references:
  - https://github.com/tevora-threat/SharpView/
  - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2023-02-14
tags:
  - attack.discovery
  - attack.t1049
  - attack.t1069.002
  - attack.t1482
  - attack.t1135
  - attack.t1033
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: SharpView.exe
    - Image|endswith: \SharpView.exe
    - CommandLine|contains:
        - Add-RemoteConnection
        - Convert-ADName
        - ConvertFrom-SID
        - ConvertFrom-UACValue
        - Convert-SidToName
        - Export-PowerViewCSV
        - Find-DomainObjectPropertyOutlier
        - Find-DomainProcess
        - Find-DomainShare
        - Find-DomainUserEvent
        - Find-DomainUserLocation
        - Find-ForeignGroup
        - Find-ForeignUser
        - Find-GPOComputerAdmin
        - Find-GPOLocation
        - Find-Interesting
        - Find-LocalAdminAccess
        - Find-ManagedSecurityGroups
        - Get-CachedRDPConnection
        - Get-DFSshare
        - Get-DomainComputer
        - Get-DomainController
        - Get-DomainDFSShare
        - Get-DomainDNSRecord
        - Get-DomainFileServer
        - Get-DomainForeign
        - Get-DomainGPO
        - Get-DomainGroup
        - Get-DomainGUIDMap
        - Get-DomainManagedSecurityGroup
        - Get-DomainObject
        - Get-DomainOU
        - Get-DomainPolicy
        - Get-DomainSID
        - Get-DomainSite
        - Get-DomainSPNTicket
        - Get-DomainSubnet
        - Get-DomainTrust
        - Get-DomainUserEvent
        - Get-ForestDomain
        - Get-ForestGlobalCatalog
        - Get-ForestTrust
        - Get-GptTmpl
        - Get-GroupsXML
        - Get-LastLoggedOn
        - Get-LoggedOnLocal
        - Get-NetComputer
        - Get-NetDomain
        - Get-NetFileServer
        - Get-NetForest
        - Get-NetGPO
        - Get-NetGroupMember
        - Get-NetLocalGroup
        - Get-NetLoggedon
        - Get-NetOU
        - Get-NetProcess
        - Get-NetRDPSession
        - Get-NetSession
        - Get-NetShare
        - Get-NetSite
        - Get-NetSubnet
        - Get-NetUser
        - Get-PathAcl
        - Get-PrincipalContext
        - Get-RegistryMountedDrive
        - Get-RegLoggedOn
        - Get-WMIRegCachedRDPConnection
        - Get-WMIRegLastLoggedOn
        - Get-WMIRegMountedDrive
        - Get-WMIRegProxy
        - Invoke-ACLScanner
        - Invoke-CheckLocalAdminAccess
        - Invoke-Kerberoast
        - Invoke-MapDomainTrust
        - Invoke-RevertToSelf
        - Invoke-Sharefinder
        - Invoke-UserImpersonation
        - Remove-DomainObjectAcl
        - Remove-RemoteConnection
        - Request-SPNTicket
        - Set-DomainObject
        - Test-AdminAccess
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1