All Detections

HackTool - SharpDPAPI Execution

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 2025013

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

Sigma