huntrule

Windows SharpChisel HackTool Execution via Process Name or Product Metadata

Alerts on Windows process executions where the SharpChisel executable or Product metadata indicates SharpChisel.

FreeUnreviewedSigmahighv1
title: Windows SharpChisel HackTool Execution via Process Name or Product Metadata
id: 20cf1244-f75a-4a0a-a92d-72a12a8556f4
related:
  - id: 8b0e12da-d3c3-49db-bb4f-256703f380e5
    type: similar
  - id: cf93e05e-d798-4d9e-b522-b0248dc61eaf
    type: derived
status: test
description: This rule flags process creation events that reference SharpChisel by matching either the executable name ending with \SharpChisel.exe or the Product field set to SharpChisel. Attackers may use SharpChisel to support command-and-control activity by running this specific client on a target host. Detection relies on Windows process creation telemetry, particularly process image paths and product metadata captured at process start.
references:
  - https://github.com/shantanu561993/SharpChisel
  - https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-05
modified: 2023-02-13
tags:
  - attack.command-and-control
  - attack.t1090.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \SharpChisel.exe
    - Product: SharpChisel
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags process creation events that reference SharpChisel by matching either the executable name ending with \SharpChisel.exe or the Product field set to SharpChisel. Attackers may use SharpChisel to support command-and-control activity by running this specific client on a target host. Detection relies on Windows process creation telemetry, particularly process image paths and product metadata captured at process start.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.