HackTool - Stracciatella Execution

Status: test
Severity: high
Log source: category process_creation, product windows
Author: pH-T (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: HackTool - Stracciatella Execution
id: 7a4d9232-92fc-404d-8ce1-4c92e7caf539
status: test
description: Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
references:
    - https://github.com/mgeeky/Stracciatella
author: pH-T (Nextron Systems)
date: 2023-04-17
modified: 2024-11-23
tags:
    - attack.execution
    - attack.defense-impairment
    - attack.t1059
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\Stracciatella.exe'
        - OriginalFileName: 'Stracciatella.exe'
        - Description: 'Stracciatella'
        - Hashes|contains:
              - 'SHA256=9d25e61ec1527e2a69d7c2a4e3fe2fe15890710c198a66a9f25d99fdf6c7b956'
              - 'SHA256=fd16609bd9830c63b9413671678bb159b89c357d21942ddbb6b93add808d121a'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|endswith: '\Stracciatella.exe'
    - OriginalFileName: 'Stracciatella.exe'
    - Description: 'Stracciatella'
    - Hashes|contains:
          - 'SHA256=9d25e61ec1527e2a69d7c2a4e3fe2fe15890710c198a66a9f25d99fdf6c7b956'
          - 'SHA256=fd16609bd9830c63b9413671678bb159b89c357d21942ddbb6b93add808d121a'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Description`	eq	`Stracciatella`	`field:"Description" kind:eq value:"Stracciatella"`
`Hashes`	match	`SHA256=9d25e61ec1527e2a69d7c2a4e3fe2fe15890710c198a66a9f25d99fdf6c7b956` `SHA256=fd16609bd9830c63b9413671678bb159b89c357d21942ddbb6b93add808d121a`	`field:"Hashes" kind:match`
`Image`	ends_with	`\Stracciatella.exe`	`field:"Image" kind:ends_with value:"\Stracciatella.exe"`
`OriginalFileName`	eq	`Stracciatella.exe`	`field:"OriginalFileName" kind:eq value:"Stracciatella.exe"`