Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

title: "Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution"
id: 96fefb16-6288-4db2-8b6a-98bb5dab7c2e
status: test
description: This rule flags execution of the Seatbelt discovery utility on Windows by matching process image details consistent with Seatbelt.exe and its command-line parameters. Attackers commonly use tools like Seatbelt to rapidly enumerate system, credentials, browser artifacts, and other host information to inform follow-on actions. It relies on Windows process creation telemetry including the executable path or metadata and the full command line arguments (group selection and output file).
references:
  - https://github.com/GhostPack/Seatbelt
  - https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_seatbelt.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-18
modified: 2023-02-04
tags:
  - attack.discovery
  - attack.t1526
  - attack.t1087
  - attack.t1083
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \Seatbelt.exe
    - OriginalFileName: Seatbelt.exe
    - Description: Seatbelt
    - CommandLine|contains:
        - " DpapiMasterKeys"
        - " InterestingProcesses"
        - " InterestingFiles"
        - " CertificateThumbprints"
        - " ChromiumBookmarks"
        - " ChromiumHistory"
        - " ChromiumPresence"
        - " CloudCredentials"
        - " CredEnum"
        - " CredGuard"
        - " FirefoxHistory"
        - " ProcessCreationEvents"
  selection_group_list:
    CommandLine|contains:
      - " -group=misc"
      - " -group=remote"
      - " -group=chromium"
      - " -group=slack"
      - " -group=system"
      - " -group=user"
      - " -group=all"
  selection_group_output:
    CommandLine|contains: " -outputfile="
  condition: selection_img or all of selection_group_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 38646daa-e78f-4ace-9de0-55547b2d30da
    type: derived