Windows Process Creation: SILENTTRINITY st2stager Stager Execution via PE Description

Flags Windows process creation events containing "st2stager" in PE metadata, indicating SILENTTRINITY stager activity.

FreeUnreviewedSigmahighv1

windows-process-creation-silenttrinity-st2stager-stager-execution-via-pe-descrip-03552375

title: "Windows Process Creation: SILENTTRINITY st2stager Stager Execution via PE Description"
id: c81a227b-7655-4018-9e0f-85d57ed3e24e
related:
  - id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d
    type: derived
  - id: 03552375-cc2c-4883-bbe4-7958d5a980be
    type: derived
status: test
description: This rule identifies process executions where the process metadata field contains the string "st2stager", indicating use of the SILENTTRINITY stager. Stager execution matters because attackers often deploy lightweight loaders to establish command-and-control or hand off to additional components. The detection relies on Windows process creation telemetry with a PE/metadata Description field that can be searched for the specified substring.
references:
  - https://github.com/byt3bl33d3r/SILENTTRINITY
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_silenttrinity_stager.yml
author: Aleksey Potapov, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2023-02-13
tags:
  - attack.command-and-control
  - attack.t1071
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Description|contains: st2stager
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies process executions where the process metadata field contains the string "st2stager", indicating use of the SILENTTRINITY stager. Stager execution matters because attackers often deploy lightweight loaders to establish command-and-control or hand off to additional components. The detection relies on Windows process creation telemetry with a PE/metadata Description field that can be searched for the specified substring.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.