SharpRMS

Reported Context (2)

The SharpRMS tool forges the signature and Rights Account Certificate (RAC) needed to decrypt the extracted slc.bin offline, unlocking every document the deployment protected. AD RMS Root-Key Extraction Can Permanently Expose Protected Documents
Both routes mean speaking the RMS SOAP protocol by hand, which is where SharpRMS comes in. SharpRMS is a custom C# post-exploitation tool that speaks the AD RMS SOAP protocol directly, the same web-service calls the RMS AD RMS Recon Shows How Domain Users Can Map Protected Content and Service-Group Boundaries

People (10)

MITRE ATT&CK (6)

Vendors (1)

Products (6)

Tools (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.