detection.wiki

Detection rules › Sigma

HackTool - SharpView Execution

Status
test
Severity
high
Log source
product windows, category process_creation
Author
frack113
Source
github.com/SigmaHQ/sigma

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1033 System Owner/User Discovery, T1049 System Network Connections Discovery, T1069.002 Permission Groups Discovery: Domain Groups, T1135 Network Share Discovery, T1482 Domain Trust Discovery

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: HackTool - SharpView Execution
id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d
related:
    - id: dcd74b95-3f36-4ed9-9598-0490951643aa
      type: similar
status: test
description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
references:
    - https://github.com/tevora-threat/SharpView/
    - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview
author: frack113
date: 2021-12-10
modified: 2023-02-14
tags:
    - attack.discovery
    - attack.t1049
    - attack.t1069.002
    - attack.t1482
    - attack.t1135
    - attack.t1033
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - OriginalFileName: 'SharpView.exe'
        - Image|endswith: '\SharpView.exe'
        - CommandLine|contains:
              # - 'Add-DomainGroupMember'
              # - 'Add-DomainObjectAcl'
              # - 'Add-ObjectAcl'
              - 'Add-RemoteConnection'
              - 'Convert-ADName'
              - 'ConvertFrom-SID'
              - 'ConvertFrom-UACValue'
              - 'Convert-SidToName'
              # - 'ConvertTo-SID'
              - 'Export-PowerViewCSV'
              # - 'Find-DomainLocalGroupMember'
              - 'Find-DomainObjectPropertyOutlier'
              - 'Find-DomainProcess'
              - 'Find-DomainShare'
              - 'Find-DomainUserEvent'
              - 'Find-DomainUserLocation'
              - 'Find-ForeignGroup'
              - 'Find-ForeignUser'
              - 'Find-GPOComputerAdmin'
              - 'Find-GPOLocation'
              - 'Find-Interesting' # 'Find-InterestingDomainAcl', 'Find-InterestingDomainShareFile', 'Find-InterestingFile'
              - 'Find-LocalAdminAccess'
              - 'Find-ManagedSecurityGroups'
              # - 'Get-ADObject'
              - 'Get-CachedRDPConnection'
              - 'Get-DFSshare'
              # - 'Get-DNSRecord'
              # - 'Get-DNSZone'
              # - 'Get-Domain'
              - 'Get-DomainComputer'
              - 'Get-DomainController'
              - 'Get-DomainDFSShare'
              - 'Get-DomainDNSRecord'
              # - 'Get-DomainDNSZone'
              - 'Get-DomainFileServer'
              - 'Get-DomainForeign' # 'Get-DomainForeignGroupMember', 'Get-DomainForeignUser'
              - 'Get-DomainGPO' # 'Get-DomainGPOComputerLocalGroupMapping', 'Get-DomainGPOLocalGroup', 'Get-DomainGPOUserLocalGroupMapping'
              - 'Get-DomainGroup' # 'Get-DomainGroupMember'
              - 'Get-DomainGUIDMap'
              - 'Get-DomainManagedSecurityGroup'
              - 'Get-DomainObject' # 'Get-DomainObjectAcl'
              - 'Get-DomainOU'
              - 'Get-DomainPolicy' # 'Get-DomainPolicyData'
              - 'Get-DomainSID'
              - 'Get-DomainSite'
              - 'Get-DomainSPNTicket'
              - 'Get-DomainSubnet'
              - 'Get-DomainTrust' # 'Get-DomainTrustMapping'
              # - 'Get-DomainUser'
              - 'Get-DomainUserEvent'
              # - 'Get-Forest'
              - 'Get-ForestDomain'
              - 'Get-ForestGlobalCatalog'
              - 'Get-ForestTrust'
              - 'Get-GptTmpl'
              - 'Get-GroupsXML'
              # - 'Get-GUIDMap'
              # - 'Get-IniContent'
              # - 'Get-IPAddress'
              - 'Get-LastLoggedOn'
              - 'Get-LoggedOnLocal'
              - 'Get-NetComputer' # 'Get-NetComputerSiteName'
              - 'Get-NetDomain' # 'Get-NetDomainController', 'Get-NetDomainTrust'
              - 'Get-NetFileServer'
              - 'Get-NetForest' # 'Get-NetForestCatalog', 'Get-NetForestDomain', 'Get-NetForestTrust'
              - 'Get-NetGPO' # 'Get-NetGPOGroup'
              # - 'Get-NetGroup'
              - 'Get-NetGroupMember'
              - 'Get-NetLocalGroup' # 'Get-NetLocalGroupMember'
              - 'Get-NetLoggedon'
              - 'Get-NetOU'
              - 'Get-NetProcess'
              - 'Get-NetRDPSession'
              - 'Get-NetSession'
              - 'Get-NetShare'
              - 'Get-NetSite'
              - 'Get-NetSubnet'
              - 'Get-NetUser'
              # - 'Get-ObjectAcl'
              - 'Get-PathAcl'
              - 'Get-PrincipalContext'
              # - 'Get-Proxy'
              - 'Get-RegistryMountedDrive'
              - 'Get-RegLoggedOn'
              # - 'Get-SiteName'
              # - 'Get-UserEvent'
              # - 'Get-WMIProcess'
              - 'Get-WMIRegCachedRDPConnection'
              - 'Get-WMIRegLastLoggedOn'
              - 'Get-WMIRegMountedDrive'
              - 'Get-WMIRegProxy'
              - 'Invoke-ACLScanner'
              - 'Invoke-CheckLocalAdminAccess'
              - 'Invoke-Kerberoast'
              - 'Invoke-MapDomainTrust'
              - 'Invoke-RevertToSelf'
              - 'Invoke-Sharefinder'
              - 'Invoke-UserImpersonation'
              # - 'New-DomainGroup'
              # - 'New-DomainUser'
              - 'Remove-DomainObjectAcl'
              - 'Remove-RemoteConnection'
              - 'Request-SPNTicket'
              # - 'Resolve-IPAddress'
              # - 'Set-ADObject'
              - 'Set-DomainObject'
              # - 'Set-DomainUserPassword'
              - 'Test-AdminAccess'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    - OriginalFileName: 'SharpView.exe'
    - Image|endswith: '\SharpView.exe'
    - CommandLine|contains:
          - 'Add-RemoteConnection'
          - 'Convert-ADName'
          - 'ConvertFrom-SID'
          - 'ConvertFrom-UACValue'
          - 'Convert-SidToName'
          - 'Export-PowerViewCSV'
          - 'Find-DomainObjectPropertyOutlier'
          - 'Find-DomainProcess'
          - 'Find-DomainShare'
          - 'Find-DomainUserEvent'
          - 'Find-DomainUserLocation'
          - 'Find-ForeignGroup'
          - 'Find-ForeignUser'
          - 'Find-GPOComputerAdmin'
          - 'Find-GPOLocation'
          - 'Find-Interesting'
          - 'Find-LocalAdminAccess'
          - 'Find-ManagedSecurityGroups'
          - 'Get-CachedRDPConnection'
          - 'Get-DFSshare'
          - 'Get-DomainComputer'
          - 'Get-DomainController'
          - 'Get-DomainDFSShare'
          - 'Get-DomainDNSRecord'
          - 'Get-DomainFileServer'
          - 'Get-DomainForeign'
          - 'Get-DomainGPO'
          - 'Get-DomainGroup'
          - 'Get-DomainGUIDMap'
          - 'Get-DomainManagedSecurityGroup'
          - 'Get-DomainObject'
          - 'Get-DomainOU'
          - 'Get-DomainPolicy'
          - 'Get-DomainSID'
          - 'Get-DomainSite'
          - 'Get-DomainSPNTicket'
          - 'Get-DomainSubnet'
          - 'Get-DomainTrust'
          - 'Get-DomainUserEvent'
          - 'Get-ForestDomain'
          - 'Get-ForestGlobalCatalog'
          - 'Get-ForestTrust'
          - 'Get-GptTmpl'
          - 'Get-GroupsXML'
          - 'Get-LastLoggedOn'
          - 'Get-LoggedOnLocal'
          - 'Get-NetComputer'
          - 'Get-NetDomain'
          - 'Get-NetFileServer'
          - 'Get-NetForest'
          - 'Get-NetGPO'
          - 'Get-NetGroupMember'
          - 'Get-NetLocalGroup'
          - 'Get-NetLoggedon'
          - 'Get-NetOU'
          - 'Get-NetProcess'
          - 'Get-NetRDPSession'
          - 'Get-NetSession'
          - 'Get-NetShare'
          - 'Get-NetSite'
          - 'Get-NetSubnet'
          - 'Get-NetUser'
          - 'Get-PathAcl'
          - 'Get-PrincipalContext'
          - 'Get-RegistryMountedDrive'
          - 'Get-RegLoggedOn'
          - 'Get-WMIRegCachedRDPConnection'
          - 'Get-WMIRegLastLoggedOn'
          - 'Get-WMIRegMountedDrive'
          - 'Get-WMIRegProxy'
          - 'Invoke-ACLScanner'
          - 'Invoke-CheckLocalAdminAccess'
          - 'Invoke-Kerberoast'
          - 'Invoke-MapDomainTrust'
          - 'Invoke-RevertToSelf'
          - 'Invoke-Sharefinder'
          - 'Invoke-UserImpersonation'
          - 'Remove-DomainObjectAcl'
          - 'Remove-RemoteConnection'
          - 'Request-SPNTicket'
          - 'Set-DomainObject'
          - 'Test-AdminAccess'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • Add-RemoteConnection
  • Convert-ADName
  • Convert-SidToName
  • ConvertFrom-SID
  • ConvertFrom-UACValue
  • Export-PowerViewCSV
  • Find-DomainObjectPropertyOutlier
  • Find-DomainProcess
  • Find-DomainShare
  • Find-DomainUserEvent
  • Find-DomainUserLocation
  • Find-ForeignGroup
  • Find-ForeignUser
  • Find-GPOComputerAdmin
  • Find-GPOLocation corpus 2 (sigma 2)
  • Find-Interesting
  • Find-LocalAdminAccess
  • Find-ManagedSecurityGroups
  • Get-CachedRDPConnection
  • Get-DFSshare
  • Get-DomainComputer corpus 2 (sigma 1, splunk 1)
  • Get-DomainController corpus 2 (sigma 1, splunk 1)
  • Get-DomainDFSShare
  • Get-DomainDNSRecord
  • Get-DomainFileServer
  • Get-DomainForeign
  • Get-DomainGPO
  • Get-DomainGUIDMap
  • Get-DomainGroup corpus 2 (sigma 1, splunk 1)
  • Get-DomainManagedSecurityGroup
  • Get-DomainOU
  • Get-DomainObject
  • Get-DomainPolicy corpus 2 (sigma 1, splunk 1)
  • Get-DomainSID
  • Get-DomainSPNTicket
  • Get-DomainSite
  • Get-DomainSubnet
  • Get-DomainTrust corpus 2 (sigma 1, splunk 1)
  • Get-DomainUserEvent
  • Get-ForestDomain
  • Get-ForestGlobalCatalog
  • Get-ForestTrust corpus 2 (sigma 1, splunk 1)
  • Get-GptTmpl
  • Get-GroupsXML
  • Get-LastLoggedOn
  • Get-LoggedOnLocal
  • Get-NetComputer
  • Get-NetDomain
  • Get-NetFileServer
  • Get-NetForest
  • Get-NetGPO
  • Get-NetGroupMember
  • Get-NetLocalGroup
  • Get-NetLoggedon
  • Get-NetOU
  • Get-NetProcess
  • Get-NetRDPSession
  • Get-NetSession
  • Get-NetShare
  • Get-NetSite
  • Get-NetSubnet
  • Get-NetUser
  • Get-PathAcl
  • Get-PrincipalContext
  • Get-RegLoggedOn
  • Get-RegistryMountedDrive
  • Get-WMIRegCachedRDPConnection
  • Get-WMIRegLastLoggedOn
  • Get-WMIRegMountedDrive
  • Get-WMIRegProxy
  • Invoke-ACLScanner corpus 2 (sigma 2)
  • Invoke-CheckLocalAdminAccess
  • Invoke-Kerberoast corpus 2 (sigma 2)
  • Invoke-MapDomainTrust
  • Invoke-RevertToSelf
  • Invoke-Sharefinder corpus 2 (sigma 2)
  • Invoke-UserImpersonation
  • Remove-DomainObjectAcl
  • Remove-RemoteConnection
  • Request-SPNTicket
  • Set-DomainObject
  • Test-AdminAccess
Imageends_with
  • \SharpView.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • SharpView.exe