SharpHide is just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.
The tool uses the following registry path in which it creates the hidden run key: (HKCU if user, else HKLM)\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Also Read – BurpSuite : Secret Finder Extension To Discover APIkeys/Tokens From HTTP Response
Usage
To Create hidden registry (Run) key:
SharpHide.exe action=create keyvalue=”C:\Windows\Temp\Bla.exe”
To Create a hidden registry (Run) key with parameters:
SharpHide.exe action=create keyvalue=”C:\Windows\Temp\Bla.exe” arguments=”arg1 arg2″
Delete hidden registry (Run) key:
SharpHide.exe action=delete
This tool also works with Cobalt Strike’s execute-assembly.
Credits: Cornelis de Plaa (@Cneelis) / Outflank
Introduction Google Dorking is a technique where advanced search operators are used to uncover information…
Linux is renowned for its versatility, open-source nature, and security. Whether you're a beginner, developer,…
Cyber insurance helps businesses and individuals mitigate financial losses from data breaches, ransomware, extortion, legal…
Ransomware is one of the most dangerous and destructive forms of cybercrime today. With cybercriminals…
Social media is a key part of our daily lives, with millions of users sharing…
What Are Data Brokers? Data brokers are companies that collect, aggregate, and sell personal information,…