huntrule

Windows PurpleSharp HackTool Execution via Process Creation

Alerts on process creation events consistent with running PurpleSharp.exe on Windows.

FreeUnreviewedSigmacriticalv1
title: Windows PurpleSharp HackTool Execution via Process Creation
id: 414b80a6-4589-4572-8ccf-24943608199f
status: test
description: This rule flags execution of the PurpleSharp adversary simulation tool on Windows by matching process image paths and original file name to PurpleSharp.exe, or by spotting command-line strings associated with PurpleSharp. Such tooling can indicate adversary emulation or misuse of legitimate simulation binaries during intrusion attempts. It relies on Windows process creation telemetry including Image/OriginalFileName and CommandLine fields.
references:
  - https://github.com/mvelazc0/PurpleSharp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_purplesharp_indicators.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-06-18
modified: 2023-02-05
tags:
  - attack.t1587
  - attack.resource-development
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|contains: \purplesharp
    - OriginalFileName: PurpleSharp.exe
  selection_cli:
    CommandLine|contains:
      - xyz123456.exe
      - PurpleSharp
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: ff23ffbc-3378-435e-992f-0624dcf93ab4
    type: derived

What it detects

This rule flags execution of the PurpleSharp adversary simulation tool on Windows by matching process image paths and original file name to PurpleSharp.exe, or by spotting command-line strings associated with PurpleSharp. Such tooling can indicate adversary emulation or misuse of legitimate simulation binaries during intrusion attempts. It relies on Windows process creation telemetry including Image/OriginalFileName and CommandLine fields.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.