huntrule

Windows SharpChisel Command-Line Execution via SharpChisel.exe

Alerts on Windows process executions where the SharpChisel executable or Product metadata indicates SharpChisel.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-09-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where the executed image ends with \SharpChisel.exe or the process product is listed as SharpChisel. SharpChisel is commonly used as a hacking tool, so command-line execution on endpoints can indicate unauthorized tunneling or access tooling. The detection relies on Windows process creation telemetry that includes the image path or executable metadata product field.

Reporting behind it

Related detections9 linkedT1090.001 — drag to rearrange
Suspicious Port Proxy Persistence Registry Key Creation (via registry_set)
Suspicious SSH Reverse Tunnel via plink (via process_creation)
Suspicious Port Forwarding via Netsh PortProxy Linked to Chinese APT Techniques
Malicious XGU Pivot Named Pipe Creation by SPECTRALVIPER
Malicious VOLTZITE Netsh Portproxy Port Forwarding via Command Line (via process_creation)
Malicious SOCKS Proxy Tunnel via Earthworm Rssocks by UAT-8837
Malicious Volt Typhoon Port Proxy Configuration via Netsh (via process_creation)
Suspicious netsh Port Proxy Configuration for Covert Tunneling
Malicious Port Forwarding Tunnel via Netsh Portproxy (via process_creation)
Windows SharpChisel Command-Line Execution via SharpChisel.exe
Pivot detection · T1090.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.