SharpHide : Tool To Create Hidden Registry Keys

SharpHide is just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.

The tool uses the following registry path in which it creates the hidden run key: (HKCU if user, else HKLM)\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Also Read – BurpSuite : Secret Finder Extension To Discover APIkeys/Tokens From HTTP Response

Usage

To Create hidden registry (Run) key:

SharpHide.exe action=create keyvalue=”C:\Windows\Temp\Bla.exe”

To Create a hidden registry (Run) key with parameters:

SharpHide.exe action=create keyvalue=”C:\Windows\Temp\Bla.exe” arguments=”arg1 arg2″

Delete hidden registry (Run) key:

SharpHide.exe action=delete

This tool also works with Cobalt Strike’s execute-assembly.

Credits: Cornelis de Plaa (@Cneelis) / Outflank

R K

Recent Posts

SpyAI : Intelligent Malware With Advanced Capabilities

SpyAI is a sophisticated form of malware that leverages advanced technologies to capture and analyze…

3 days ago

Proxmark3 : The Ultimate Tool For RFID Security And Analysis

The Proxmark3 is a versatile, open-source tool designed for radio-frequency identification (RFID) security analysis, research,…

3 days ago

Awesome Solana Security : Enhancing Program Development

The "Awesome Solana Security" collection is a comprehensive resource designed to help developers build more…

3 days ago

IngressNightmare-POCs : Understanding The Vulnerability Exploitation Flow

The "IngressNightmare" vulnerabilities, disclosed in March 2025, represent a critical set of security issues affecting…

3 days ago

AdaptixC2 : Enhancing Penetration Testing With Advanced Framework Capabilities

AdaptixC2 is an advanced post-exploitation and adversarial emulation framework designed specifically for penetration testers. It…

3 days ago

Bincrypter : Enhancing Linux Binary Security through Runtime Encryption And Obfuscation

Bincrypter is a powerful Linux binary runtime crypter written in BASH. It is designed to…

3 days ago