HackTool - Stracciatella Execution

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•3

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.