HackTool - SharpMove Tool Execution

Title: HackTool - SharpMove Tool Execution
Status: test
Description:Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.
References:
  -https://github.com/0xthirteen/SharpMove/
  -https://pentestlab.blog/tag/sharpmove/
Author: Luca Di Bartolomeo (CrimpSec)
Date: 2024-01-29
modified:None
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\SharpMove.exe' OriginalFileName:'SharpMove.exe'   selection_cli_computer:
    CommandLine|contains: 'computername='
  selection_cli_actions:
    CommandLine|contains:
      -'action=create'
      -'action=dcom'
      -'action=executevbs'
      -'action=hijackdcom'
      -'action=modschtask'
      -'action=modsvc'
      -'action=query'
      -'action=scm'
      -'action=startservice'
      -'action=taskscheduler'

  condition:selection_img or all of selection_cli_*
Falsepositives:
  -Unknown
Level: high