HKTL - SharpSuccessor Privilege Escalation Tool Execution

SigmaHQ Detections@sigmaHQ

•updated Jun 12, 2025•0•13

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in Windows Server 2025 Active Directory environments. Successful usage of this tool can let attackers gain domain admin privileges by exploiting the BadSuccessor vulnerability.