Rule Info
Name
Renamed SharpHound.EXE Execution
Author
X__Junior (Nextron Systems)
Description
Detects the execution of a renamed "SharpHound.exe" binary based on the PE metadata fields
Date
2024-09-25 00:00:00
Modified
2026-03-24 00:00:00
Id
33c0eeee-311b-4c8c-a067-8ca12c6a5657
Tags
attack.stealth attack.execution attack.t1059 attack.t1202
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR