Query: rule covering Detects the use of SharpUp, a tool for local privilege escalation
Matching passage: Sigma rule: Detects the use of SharpUp, a tool for local privilege escalation. Logsource: windows / process_creation. Rule: title: HackTool - SharpUp PrivEsc Tool Execution id: c484e533-ee16-4a93-b6ac-f0ea4868b2f1 status: test description: Detects the use of SharpUp, a tool for local privilege escalation references: - https://github.com/GhostPack/SharpUp author: Florian Roth (Nextron Systems) date: 2022-08-20 modified: 2023-02-13 tags: - attack.persistence - attack.privilege-escalation - attack.discovery - attack.execution - attack.stealth - attack.t1615 - attack.t1569.002 - attack.t1574.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SharpUp.exe - Description: SharpUp - CommandLine|contains: - HijackablePaths - UnquotedServicePath - ProcessDLLHijack - ModifiableServiceBinaries - ModifiableScheduledTask - DomainGPPPassword - CachedGPPPassword condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for C. Logsource: windows / registry_delete. Rule: title: Removal of Potential COM Hijacking Registry Keys id: 96f697b0-b499-4e5d-9908-a67bec11cdb6 status: test description: 'Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks. ' references: - https://github.com/OTRF/detection-hackathon-apt29/issues/7 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md - https://learn.microsoft.com/en-us/windows/win32/shell/launch - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand - https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-10-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_delete detection: selection: TargetObject|endswith: \shell\open\command filter_main_explorer: Image|endswith: C:\Windows\explorer.exe filter_main_svchost: Image: C:\Windows\system32\svchost.exe filter_main_msiexec: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_generic_prorams: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_openwith: Image: C:\Windows\System32\OpenWith.exe filter_optional_dropbox: Image|endswith: \Dropbox.exe TargetObject|contains: \Dropbox. filter_optional_wireshark: Image|endswith: \AppData\Local\Temp\Wireshark_uninstaller.exe TargetObject|contains: \wireshark-capture-file\ filter_optional_peazip: Image|contains: peazip TargetObject|contains: \PeaZip. filter_optional_everything: Image|endswith: \Everything.exe TargetObject|contains: \Everything. filter_optional_uninstallers: Image|startswith: C:\Windows\Installer\MSI filter_optional_java: Image|startswith: C:\Program Files (x86)\Java\ Image|endswith: \installer.exe TargetObject|contains: \Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F} filter_optional_edgeupdate: Image|contains: \Microsoft\EdgeUpdate\Install filter_optional_avira: Image: - C:\Program Files (x86)\Avira\Antivirus\ - C:\Program Files\Avira\Antivirus\ TargetObject|endswith: - \CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command - \AntiVir.Keyfile\shell\open\command filter_optiona