huntrule

Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)

Flags Windows process creation events containing "st2stager" in PE metadata, indicating SILENTTRINITY stager activity.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Aleksey Potapov, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-22
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the process description contains the string 'st2stager', indicating execution of a SILENTTRINITY stager. Attackers may use such stagers to establish command-and-control by launching follow-on payloads with minimal visibility. The detection relies on process creation telemetry and the availability of a process description field that includes embedded metadata.

Reporting behind it

Related detections6 linkedT1071 — drag to rearrange
Suspicious SSH Service on Non Standard Port 57722
Suspicious Bash Reverse Shell via /dev/tcp
Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener
macOS Installer Scripts Spawning Suspicious Interpreter Child Processes
Windows DNS analytic events for GALLIUM-related ddns QNAMEs (EventID 257)
Windows Process Creation alerts on GALLIUM-associated hash IOCs
Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)
Pivot detection · T1071 · 6 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.