SharpImpersonation Tool Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of the SharpImpersonation tool, which is used for manipulating tokens on Windows systems. This can occur remotely via tools like PsExec/WmiExec or interactively. The rule specifically looks for the executable name or command-line arguments indicating token manipulation techniques such as 'CreateProcessAsUserW' or 'ImpersonateLoggedOnUser', often combined with 'user:' and 'binary:' or 'shellcode:' parameters.