Loading malware…
SharpSploit is an open-source .NET post-exploitation library written in C# for penetration testing and red-team operations on Windows. It exposes offensive capabilities through .NET and Windows APIs, incorporating techniques and selected functionality from PowerSploit and other security projects rather than serving as a direct PowerSploit port. Covenant uses SharpSploit extensively for its post-exploitation features.
SharpSploit includes functionality for in-memory code execution, process dumping, and defense evasion, including techniques for bypassing AMSI and PowerShell logging. Portions of its code have been used to inject malicious .NET assemblies into legitimate processes without writing malicious modules to disk. Such use was observed in Operation Cache Panda, an intrusion affecting Taiwanese financial-sector organizations. VenomRAT also incorporates dynamic Windows API resolution code closely resembling SharpSploit and D/Invoke implementations. SharpSploit is a dual-use offensive library, not a standalone malware family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An offensive security project referenced as inspiration for VenomRAT's AMSI/ETW bypass and D/Invoke-style functionality; not described here as malware itself.
Code from SharpSploit was used to inject malicious .NET payloads in memory for stealthier execution.
Listed as an attack tool leveraging underlying PowerShell components, illustrating how attackers can evade controls focused only on the PowerShell executable or interface.
Offensive .NET library used by Covenant for functionality; mentioned as a supporting component rather than the main subject.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.