SharpUp Privilege Escalation Tool Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•3•0•52

Detects the execution of SharpUp, a tool used for local privilege escalation. The rule specifically looks for the executable name 'SharpUp.exe' or the description 'SharpUp', combined with command-line arguments indicative of its privilege escalation enumeration capabilities, such as 'HijackablePaths', 'UnquotedServicePath', 'ProcessDLLHijack', 'ModifiableServiceBinaries', 'ModifiableScheduledTask', 'DomainGPPPassword', and 'CachedGPPPassword'.