Attack Tool(s): SharpStay, SharPersist, StayKit, PsExec
- SharpStay: https://github.com/0xthirteen/SharpStay
- SharPersist: https://github.com/mandiant/SharPersist
- StayKit: https://github.com/0xthirteen/StayKit
- PsExec: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
Detection Link(s):
- Endpoint Security Protection Analysis
- Memory Analysis’
- Endpoint Security
- Security Information and Event Management (SIEM) Log Analysis
Helpful Blogs (BHIS):
- “Digging Deeper: Vulnerable Windows Services” – https://www.blackhillsinfosec.com/digging-deeper-vulnerable-windows-services – Service persistence.
