Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)

Flags Windows process creation events containing "st2stager" in PE metadata, indicating SILENTTRINITY stager activity.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Aleksey Potapov, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-22
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071Application Layer Protocol
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the process description contains the string 'st2stager', indicating execution of a SILENTTRINITY stager. Attackers may use such stagers to establish command-and-control by launching follow-on payloads with minimal visibility. The detection relies on process creation telemetry and the availability of a process description field that includes embedded metadata.

Reporting behind it

Related detections9 linkedT1071 — drag to rearrange

Malicious JADEPUFFER Python Beacon via Cron

Malicious Keyhunter Worker Persistence via Systemd Service

Suspicious Python Process Establishing PostgreSQL Command and Control Channel

Possible WailingCrab MQTT C2 to Public Broker (via network_connection)

Suspicious Outbound Network Connection from explorer.exe

Suspicious SSH Service on Non Standard Port 57722

Suspicious Bash Reverse Shell via /dev/tcp

Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener

macOS Installer Scripts Spawning Suspicious Interpreter Child Processes

Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)

Pivot detection · T1071 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-silenttrinity-st2stager-stager-execution-via-pe-descrip-03552375

title: Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)
id: c81a227b-7655-4018-9e0f-85d57ed3e24e
related:
  - id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d
    type: derived
  - id: 03552375-cc2c-4883-bbe4-7958d5a980be
    type: derived
status: test
description: This rule flags Windows process creation events where the process description contains the string 'st2stager', indicating execution of a SILENTTRINITY stager. Attackers may use such stagers to establish command-and-control by launching follow-on payloads with minimal visibility. The detection relies on process creation telemetry and the availability of a process description field that includes embedded metadata.
references:
  - https://github.com/byt3bl33d3r/SILENTTRINITY
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_silenttrinity_stager.yml
author: Aleksey Potapov, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2023-02-13
tags:
  - attack.command-and-control
  - attack.t1071
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Description|contains: st2stager
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL