HackTool - Stracciatella Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•16

Detects the execution of Stracciatella, a hack tool that executes PowerShell runspaces from within C# (SharpPick technique) while attempting to disable AMSI, ETW, and Script Block Logging. Detection is based on the executable's name, original filename, description, or specific SHA256 hashes.