HackTool - SharpChisel Execution

Title: HackTool - SharpChisel Execution
Status: test
Description:Detects usage of the Sharp Chisel via the commandline arguments
References:
  -https://github.com/shantanu561993/SharpChisel
  -https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-05
modified:2023-02-13
Tags:

• -'attack.command-and-control'
• -'attack.t1090.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\SharpChisel.exe' Product:'SharpChisel'   condition:selection
Falsepositives:
  -Unlikely
Level: high