SharpHide is just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.
The tool uses the following registry path in which it creates the hidden run key: (HKCU if user, else HKLM)\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Also Read – BurpSuite : Secret Finder Extension To Discover APIkeys/Tokens From HTTP Response
Usage
To Create hidden registry (Run) key:
SharpHide.exe action=create keyvalue=”C:\Windows\Temp\Bla.exe”
To Create a hidden registry (Run) key with parameters:
SharpHide.exe action=create keyvalue=”C:\Windows\Temp\Bla.exe” arguments=”arg1 arg2″
Delete hidden registry (Run) key:
SharpHide.exe action=delete
This tool also works with Cobalt Strike’s execute-assembly.
Credits: Cornelis de Plaa (@Cneelis) / Outflank
Both git fetch and git pull talk to a remote repository, but they do very different things to your…
Sometimes the change you need already exists, just on the wrong branch. A hotfix lands…
Email is still one of the most important communication channels inside modern applications. Password resets,…
Nginx is a high-performance web server and reverse proxy trusted by some of the largest…
ufw (Uncomplicated Firewall) sits on top of iptables (or nftables on newer systems) and replaces…
When you share a server with a team or investigate unexpected activity, the first question…