HackTool - PurpleSharp Execution

Title: HackTool - PurpleSharp Execution
Status: test
Description:Detects the execution of the PurpleSharp adversary simulation tool
References:
  -https://github.com/mvelazc0/PurpleSharp
Author: Florian Roth (Nextron Systems)
Date: 2021-06-18
modified:2023-02-05
Tags:

• -'attack.t1587'
• -'attack.resource-development'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|contains:'\purplesharp' OriginalFileName:'PurpleSharp.exe'   selection_cli:
    CommandLine|contains:
      -'xyz123456.exe'
      -'PurpleSharp'

  condition:1 of selection_*
Falsepositives:
  -Unlikely
Level: critical