HackTool - SharpMove Tool Execution

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Luca Di Bartolomeo (CrimpSec)
Source: github.com/SigmaHQ/sigma

Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: HackTool - SharpMove Tool Execution
id: 055fb54c-a8f4-4aee-bd44-f74cf30a0d9d
status: test
description: |
    Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.
references:
    - https://github.com/0xthirteen/SharpMove/
    - https://pentestlab.blog/tag/sharpmove/
author: Luca Di Bartolomeo (CrimpSec)
date: 2024-01-29
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\SharpMove.exe'
        - OriginalFileName: SharpMove.exe
    selection_cli_computer:
        # In its current implementation the "computername" flag is required in all actions
        CommandLine|contains: 'computername='
    selection_cli_actions:
        CommandLine|contains:
            - 'action=create'
            - 'action=dcom'
            - 'action=executevbs'
            - 'action=hijackdcom'
            - 'action=modschtask'
            - 'action=modsvc'
            - 'action=query'
            - 'action=scm'
            - 'action=startservice'
            - 'action=taskscheduler'
    condition: selection_img or all of selection_cli_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection_img or all of selection_cli_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\SharpMove.exe'
    - OriginalFileName: SharpMove.exe

Stage 2: `selection_cli_computer`

selection_cli_computer:
    CommandLine|contains: 'computername='

Stage 3: `selection_cli_actions`

selection_cli_actions:
    CommandLine|contains:
        - 'action=create'
        - 'action=dcom'
        - 'action=executevbs'
        - 'action=hijackdcom'
        - 'action=modschtask'
        - 'action=modsvc'
        - 'action=query'
        - 'action=scm'
        - 'action=startservice'
        - 'action=taskscheduler'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`action=create` `action=dcom` `action=executevbs` `action=hijackdcom` `action=modschtask` `action=modsvc` `action=query` `action=scm` `action=startservice` `action=taskscheduler` `computername=`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\SharpMove.exe`	`field:"Image" kind:ends_with value:"\SharpMove.exe"`
`OriginalFileName`	eq	`SharpMove.exe`	`field:"OriginalFileName" kind:eq value:"SharpMove.exe"`