Windows SharpChisel Command-Line Execution via SharpChisel.exe
Alerts on Windows process executions where the SharpChisel executable or Product metadata indicates SharpChisel.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-05
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process creation events where the executed image ends with \SharpChisel.exe or the process product is listed as SharpChisel. SharpChisel is commonly used as a hacking tool, so command-line execution on endpoints can indicate unauthorized tunneling or access tooling. The detection relies on Windows process creation telemetry that includes the image path or executable metadata product field.
Reporting behind it
- github.comhttps://github.com/shantanu561993/SharpChisel
- sentinelone.comhttps://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows SharpChisel Command-Line Execution via SharpChisel.exe
id: 20cf1244-f75a-4a0a-a92d-72a12a8556f4
related:
- id: 8b0e12da-d3c3-49db-bb4f-256703f380e5
type: similar
- id: cf93e05e-d798-4d9e-b522-b0248dc61eaf
type: derived
status: test
description: This rule flags process creation events where the executed image ends with \SharpChisel.exe or the process product is listed as SharpChisel. SharpChisel is commonly used as a hacking tool, so command-line execution on endpoints can indicate unauthorized tunneling or access tooling. The detection relies on Windows process creation telemetry that includes the image path or executable metadata product field.
references:
- https://github.com/shantanu561993/SharpChisel
- https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-05
modified: 2023-02-13
tags:
- attack.command-and-control
- attack.t1090.001
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \SharpChisel.exe
- Product: SharpChisel
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1