Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071Application Layer Protocol
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the process description contains the string 'st2stager', indicating execution of a SILENTTRINITY stager. Attackers may use such stagers to establish command-and-control by launching follow-on payloads with minimal visibility. The detection relies on process creation telemetry and the availability of a process description field that includes embedded metadata.

Reporting behind it

Related detections6 linkedT1071 — drag to rearrange

Suspicious SSH Service on Non Standard Port 57722

Suspicious Bash Reverse Shell via /dev/tcp

Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener

macOS Installer Scripts Spawning Suspicious Interpreter Child Processes

Windows DNS analytic events for GALLIUM-related ddns QNAMEs (EventID 257)

Windows Process Creation alerts on GALLIUM-associated hash IOCs

Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)

Pivot detection · T1071 · 6 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-silenttrinity-st2stager-stager-execution-via-pe-descrip-03552375

title: Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)
id: c81a227b-7655-4018-9e0f-85d57ed3e24e
related:
  - id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d
    type: derived
  - id: 03552375-cc2c-4883-bbe4-7958d5a980be
    type: derived
status: test
description: This rule flags Windows process creation events where the process description contains the string 'st2stager', indicating execution of a SILENTTRINITY stager. Attackers may use such stagers to establish command-and-control by launching follow-on payloads with minimal visibility. The detection relies on process creation telemetry and the availability of a process description field that includes embedded metadata.
references:
  - https://github.com/byt3bl33d3r/SILENTTRINITY
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_silenttrinity_stager.yml
author: Aleksey Potapov, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2023-02-13
tags:
  - attack.command-and-control
  - attack.t1071
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Description|contains: st2stager
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL