SharpHide is just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.
The tool uses the following registry path in which it creates the hidden run key: (HKCU if user, else HKLM)\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Also Read – BurpSuite : Secret Finder Extension To Discover APIkeys/Tokens From HTTP Response
Usage
To Create hidden registry (Run) key:
SharpHide.exe action=create keyvalue=”C:\Windows\Temp\Bla.exe”
To Create a hidden registry (Run) key with parameters:
SharpHide.exe action=create keyvalue=”C:\Windows\Temp\Bla.exe” arguments=”arg1 arg2″
Delete hidden registry (Run) key:
SharpHide.exe action=delete
This tool also works with Cobalt Strike’s execute-assembly.
Credits: Cornelis de Plaa (@Cneelis) / Outflank
A data protection platform is a unified system that helps organizations discover, classify, monitor, and…
AI companies operating in or around Switzerland face a compliance challenge that most legal teams…
Two major data privacy laws now govern how organizations handle personal data across Europe; the…
This cheat sheet covers the essential Kali Linux commands every pentester and ethical hacker uses…
When I first started learning malware analysis and reverse engineering, I thought the hardest part…
Both git fetch and git pull talk to a remote repository, but they do very different things to your…