huntrule

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Alerts on Windows process launches of Seatbelt.exe with discovery group arguments and outputfile usage.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-10-18
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags execution of the Seatbelt discovery utility on Windows by matching process image details consistent with Seatbelt.exe and its command-line parameters. Attackers commonly use tools like Seatbelt to rapidly enumerate system, credentials, browser artifacts, and other host information to inform follow-on actions. It relies on Windows process creation telemetry including the executable path or metadata and the full command line arguments (group selection and output file).

Reporting behind it

Related detections9 linkedT1083 — drag to rearrange
Suspicious Azure OpenAI Model Enumeration and Deployment Creation (via azure)
Suspicious ROADtools User Agent Against Microsoft Graph (via azure)
Malicious AzureHound Cloud Reconnaissance via User Agent (via azure)
Suspicious S3 Access from Desktop File Transfer Clients by Bling Libra
Possible Nagios XI Path Traversal via Graphtemplates Directory Parameter
Suspicious Credential String Enumeration via findstr to Temp Directory
Suspicious Bazar Network Reconnaissance Command Batch
Suspicious ipconfig Reconnaissance Output Redirected to CentreStack Log File
Possible osTicket PHP Filter Chain Injection via Anonymous Ticket Endpoints (via webserver)
Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution
Pivot detection · T1083 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.