HackTool - SharpView Execution

Severity: high
Author: frack113
Source: upstream

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1033` System Owner/User Discovery, `T1049` System Network Connections Discovery, `T1069.002` Permission Groups Discovery: Domain Groups, `T1135` Network Share Discovery, `T1482` Domain Trust Discovery

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `selection`

or:
CommandLine|contains: Add-RemoteConnection
CommandLine|contains: Convert-ADName
CommandLine|contains: Convert-SidToName
CommandLine|contains: ConvertFrom-SID
CommandLine|contains: ConvertFrom-UACValue
CommandLine|contains: Export-PowerViewCSV
CommandLine|contains: Find-DomainObjectPropertyOutlier
CommandLine|contains: Find-DomainProcess
CommandLine|contains: Find-DomainShare
CommandLine|contains: Find-DomainUserEvent
CommandLine|contains: Find-DomainUserLocation
CommandLine|contains: Find-ForeignGroup
CommandLine|contains: Find-ForeignUser
CommandLine|contains: Find-GPOComputerAdmin
CommandLine|contains: Find-GPOLocation
CommandLine|contains: Find-Interesting
CommandLine|contains: Find-LocalAdminAccess
CommandLine|contains: Find-ManagedSecurityGroups
CommandLine|contains: Get-CachedRDPConnection
CommandLine|contains: Get-DFSshare
CommandLine|contains: Get-DomainComputer
CommandLine|contains: Get-DomainController
CommandLine|contains: Get-DomainDFSShare
CommandLine|contains: Get-DomainDNSRecord
CommandLine|contains: Get-DomainFileServer
CommandLine|contains: Get-DomainForeign
CommandLine|contains: Get-DomainGPO
CommandLine|contains: Get-DomainGUIDMap
CommandLine|contains: Get-DomainGroup
CommandLine|contains: Get-DomainManagedSecurityGroup
CommandLine|contains: Get-DomainOU
CommandLine|contains: Get-DomainObject
CommandLine|contains: Get-DomainPolicy
CommandLine|contains: Get-DomainSID
CommandLine|contains: Get-DomainSPNTicket
CommandLine|contains: Get-DomainSite
CommandLine|contains: Get-DomainSubnet
CommandLine|contains: Get-DomainTrust
CommandLine|contains: Get-DomainUserEvent
CommandLine|contains: Get-ForestDomain
CommandLine|contains: Get-ForestGlobalCatalog
CommandLine|contains: Get-ForestTrust
CommandLine|contains: Get-GptTmpl
CommandLine|contains: Get-GroupsXML
CommandLine|contains: Get-LastLoggedOn
CommandLine|contains: Get-LoggedOnLocal
CommandLine|contains: Get-NetComputer
CommandLine|contains: Get-NetDomain
CommandLine|contains: Get-NetFileServer
CommandLine|contains: Get-NetForest
CommandLine|contains: Get-NetGPO
CommandLine|contains: Get-NetGroupMember
CommandLine|contains: Get-NetLocalGroup
CommandLine|contains: Get-NetLoggedon
CommandLine|contains: Get-NetOU
CommandLine|contains: Get-NetProcess
CommandLine|contains: Get-NetRDPSession
CommandLine|contains: Get-NetSession
CommandLine|contains: Get-NetShare
CommandLine|contains: Get-NetSite
CommandLine|contains: Get-NetSubnet
CommandLine|contains: Get-NetUser
CommandLine|contains: Get-PathAcl
CommandLine|contains: Get-PrincipalContext
CommandLine|contains: Get-RegLoggedOn
CommandLine|contains: Get-RegistryMountedDrive
CommandLine|contains: Get-WMIRegCachedRDPConnection
CommandLine|contains: Get-WMIRegLastLoggedOn
CommandLine|contains: Get-WMIRegMountedDrive
CommandLine|contains: Get-WMIRegProxy
CommandLine|contains: Invoke-ACLScanner
CommandLine|contains: Invoke-CheckLocalAdminAccess
CommandLine|contains: Invoke-Kerberoast
CommandLine|contains: Invoke-MapDomainTrust
CommandLine|contains: Invoke-RevertToSelf
CommandLine|contains: Invoke-Sharefinder
CommandLine|contains: Invoke-UserImpersonation
CommandLine|contains: Remove-DomainObjectAcl
CommandLine|contains: Remove-RemoteConnection
CommandLine|contains: Request-SPNTicket
CommandLine|contains: Set-DomainObject
CommandLine|contains: Test-AdminAccess
Image|endswith: '\SharpView.exe'
OriginalFileName: SharpView.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.