Description
SharPersist is a public .NET toolkit that establishes persistence in Windows environments through scheduled tasks, startup folders, registry keys, and other mechanisms. Red teams use it in authorized testing, and cyberattackers use it to maintain access to networks they have compromised.
Stats
- First seen
- February 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Application.Fochi.SharPersist.B |
| Generic.Application.Fochi.SharPersist.4900D3C4 |
| Generic.Application.Fochi.SharPersist.79DC8DB0 |
| Generic.Application.Fochi.SharPersist.7D38F539 |
| Generic.Application.Fochi.SharPersist.991DC6E0 |
| Generic.Application.Fochi.SharPersist.B0B895BA |
| Generic.Application.Fochi.SharPersist.C60FAFAC |
| Generic.Application.Fochi.SharPersist.EDDCA45A |
| Generic.Application.Fochi.SharPersist.F17C07F0 |