https://github.com/outflanknl/sharphide
Tool to create hidden registry keys.
https://github.com/outflanknl/sharphide
Last synced: 6 months ago
JSON representation
Tool to create hidden registry keys.
- Host: GitHub
- URL: https://github.com/outflanknl/sharphide
- Owner: outflanknl
- Created: 2019-10-20T14:25:47.000Z (almost 6 years ago)
- Default Branch: master
- Last Pushed: 2019-10-23T10:44:22.000Z (almost 6 years ago)
- Last Synced: 2025-03-30T05:04:51.263Z (6 months ago)
- Language: C#
- Homepage:
- Size: 11.7 KB
- Stars: 480
- Watchers: 24
- Forks: 94
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# SharpHide
Just a nice persistence trick to confuse DFIR investigation.
Uses NtSetValueKey native API to create a hidden (null terminated) registry key.
This works by adding a null byte in front of the UNICODE_STRING key valuename.
More info about this technique can be found in the following whitepaper:
https://github.com/ewhitehats/InvisiblePersistence/blob/master/InvisibleRegValues_Whitepaper.pdf
The tool uses the following registry path in which it creates the hidden run key:
(HKCU if user, else HKLM)\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
## Usage
To Create hidden registry (Run) key:
```
SharpHide.exe action=create keyvalue="C:\Windows\Temp\Bla.exe"
```
To Create a hidden registry (Run) key with parameters:
```
SharpHide.exe action=create keyvalue="C:\Windows\Temp\Bla.exe" arguments="arg1 arg2"
```
Delete hidden registry (Run) key:
```
SharpHide.exe action=delete
```
This tool also works with Cobalt Strike's execute-assembly.
## Credits
Author: Cornelis de Plaa (@Cneelis) / Outflank