SharpHoundMalware
According to its Github repository, SharpHound is a C# Data Collector for BloodHound.From MISP Galaxy
Last reported 3 days ago, by Help Net Security6 reports
ATT&CK techniques
6 of 41 · each with the sentence it comes from- T1003.001LSASS Memory
“LSASS Memory - T1003.001”
- T1003.006DCSync
“DCSync - T1003.006”
- T1016System Network Configuration Discovery
“System Network Configuration Discovery - T1016”
- T1018Remote System Discovery
“Remote System Discovery - T1018”
- T1021.001Remote Desktop Protocol
“Remote Desktop Protocol - T1021.001”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information - T1027”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June“…d exploitation by several threat groups, including the Qilin and Settra ransomware operations, and found Cobalt Strike, BloodHound and SharpHound in the related activity.”
-
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups“…actively exploiting the flaw, with observed accompanying deployment of offensive security tools, such as Cobalt Strike, BloodHound and SharpHound.”
-
AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration“If an attacker drops SharpHound, security tools instantly recognize the binary.”
-
The (!FALSE) Pattern“This differs significantly from SharpHound (Part 3), which uses SDFlags:0x4 or 0x5 only when needed for security descriptor enumeration.”
-
SDFlags“Figure 1: SharpHound group enumeration query captured in Event ID 1644, showing SDFlags:0x5 (Owner + DACL) and the characteristic sAMAccountType filter for all group types.”
-
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs“They leveraged various tools such as AdFind, SharpHound, SoftPerfect NetScan, and GT_NET.exe (Grixba) to map out the environment and perform reconnaissance activities.”
Indicators in its reports
named in the reports above- delete[.]mein 1 report
- hxxps://cwe.mitre[.]org/data/definitions/427.htmlin 1 report
- 45.141.87[.]55in 1 report
- 149.28.101[.]219in 1 report
- 504e1c95.host.njalla[.]netin 1 report
- 504ec1c95.host.njalla[.]netin 1 report
- 144.202.61[.]209in 1 report
- 80.78.28[.]149in 1 report
- 71f703024c3d3bfc409f66bb61f971a0in 1 report
- f24fc14f39c160b5…a605ec0eb04fin 1 report
- bcff246f0739ed98…5c3f050c7805in 1 report
- e963d598a86c5ee428a2eefa34d1ffbbin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.