SharpGetUserLoginIPRP Collects Domain Logon Data

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•6

Detects execution of the login-information extractor SharpGetUserLoginIPRP with embedded user, password, host, and day-range parameters. This tool is known to collect domain logon data.