Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Jun 29, 2022 | Updated Jan 04, 2026

HackTool:PowerShell/SharpHound.B

Detected by Microsoft Defender Antivirus

Aliases: No associated aliases

Summary

HackTool:PowerShell/SharpHound.B is a legitimate security tool designed for auditing Microsoft Active Directory environments. It functions as a highly efficient data collector, mapping the complex relationships between users, groups, devices, and permissions within a domain. Security professionals use it to identify misconfigurations and vulnerable attack paths. However, this same capability makes it a powerful reconnaissance tool for threat actors. Following an initial breach, they can deploy SharpHound to understand the network layout, identify high-value targets like domain administrators, and chart a path of least resistance for privilege escalation and lateral movement. Microsoft categorizes it as a "HackTool" as its presence on a network outside of a controlled audit is a strong indicator of malicious reconnaissance activity. Its impact is not direct damage, but the significant risk it creates by revealing the blueprint for a potential network-wide compromise. 

  • Isolate the compromised host from the network. Disable its network adapter or segment it into a quarantined VLAN to stop all data collection and prevent lateral movement. 
  • Assume the credentials used to run SharpHound are compromised. Force a password reset for the associated user account, and any other accounts logged onto that host. Prioritize resetting credentials for any privileged accounts that were enumerated. 
  • Conduct a forensic review of the host. Use the collected Indicators of Compromise (file names, hashes, registry reads) to search for and remove all SharpHound-related files and any other threat actor tools. Analyze the SharpHound output files (if found) to determine exactly what data was exposed, as this reveals the threat actor's knowledge and likely next targets. 
  • Aggregately review logs from the compromised host, domain controllers, and network sensors to identify the initial attack vector (for example, phishing, exploited vulnerability) and determine if other systems are involved. 
  • For critically compromised devices, consider rebuilding from known-clean backups or performing a complete wipe and reinstall of Windows and applications. 

Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts. 

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help. 

Follow us