SharpHound Reconnaissance via RPC Workstation Service

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•40

Detects remote RPC calls used by SharpHound to map remote connections and local group membership. This rule specifically targets the MS-WKST protocol (Workstation Service Remote Protocol) interface UUID and operation number associated with SharpHound's reconnaissance activities.