huntrule

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Alerts on Windows process launches of Seatbelt.exe with discovery group arguments and outputfile usage.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-10-18
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags execution of the Seatbelt discovery utility on Windows by matching process image details consistent with Seatbelt.exe and its command-line parameters. Attackers commonly use tools like Seatbelt to rapidly enumerate system, credentials, browser artifacts, and other host information to inform follow-on actions. It relies on Windows process creation telemetry including the executable path or metadata and the full command line arguments (group selection and output file).

Reporting behind it

Related detections9 linkedT1526 — drag to rearrange
Suspicious Azure CLI Enumeration of Roles and Logic Apps
Possible Local File Inclusion Path Traversal Targeting CentreStack Web.config
Suspicious AWS Organizations and Account Discovery via aws (via cloudtrail)
Suspicious Active Directory Discovery via ADFind
Suspicious Anonymous Access to Kubernetes API Server via Audit Log
Suspicious Active Directory Enumeration via Sysinternals AD Explorer Snapshot (via process_creation)
Malicious Directory Enumeration With Recon Tooling User Agent via Azure AD Graph
Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)
PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch
Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution
Pivot detection · T1526 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.