Detection rules › Sigma

HKTL - SharpSuccessor Privilege Escalation Tool Execution

Severity
high
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
upstream

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1068 Exploitation for Privilege Escalation

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: selection

or:
CommandLine|contains: ' /account'
CommandLine|contains: ' /impersonate'
CommandLine|contains: ' /name'
CommandLine|contains: ' /path'
CommandLine|contains: ' add '
CommandLine|contains: SharpSuccessor
Image|endswith: '\SharpSuccessor.exe'
OriginalFileName: SharpSuccessor.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /account
  • /impersonate
  • /name
  • /path
  • add corpus 11 (sigma 11)
  • SharpSuccessor
Imageends_with
  • \SharpSuccessor.exe
OriginalFileNameeq
  • SharpSuccessor.exe