Cyritex Security Lab | SHARPHOUND toolset has been integrated into the attack simulation library, enhancing AD security attack simulation!

As is known to all, Active Directory (AD) stores all account information and is used for domain environment management and permission management in most enterprises that use it. Since ransomware became widely known in 2017, according to analysis by relevant institutions, 95% of ransomware incidents have included attacks on the AD domain environment to obtain accounts of high-privileged users, thereby achieving the attacker's goals. Mimikatz is a very famous tool used to obtain relevant information in AD. However, according to research by Saixun Security Labs, SHARPHOUND is also being used in more and more attacks.

▌Introduction to the New SHARPHOUND Variant

SHARPHOUND is a C# rewrite of BLOODHOUND Ingestor. Attackers use the SHARPHOUND tool to collect environmental information about the target AD, collect user session information from the entire domain (including group memberships, local administrators, ACLs, Remote Desktop users, etc.), and enumerate trust relationships between domains. It can be used to identify different attack paths and privilege escalation paths in AD. Currently, there is also a PowerShell-based variant. SHARPHOUND packages the finally collected information into files, which can then be exfiltrated through C&C channels.

▌Simulation Attack Library Update

You can now directly search for SHARPHOUND in our platform to get all attack simulation experiments related to SHARPHOUND, including the network download of this tool and its variants, as well as the execution of this tool on hosts. This is to test the detection and defense capabilities of your network security detection and defense measures, as well as terminal/host defense measures, against this tool, its variants, and its behaviors. This reduces the probability of these tools being deployed in the environment and the probability of domain controllers being attacked, thereby increasing the likelihood of blocking hacker attacks in these phases.