HackTool - SharPersist Execution for Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•20

Detects the execution of the hacktool SharPersist, which is used to deploy various persistence mechanisms on Windows systems. The rule specifically identifies SharPersist.exe being executed with command-line arguments indicative of creating scheduled tasks, modifying startup folders, adding registry run keys, or installing new services for persistence.