{"id":"38646daa-e78f-4ace-9de0-55547b2d30da","title":"PUA - Seatbelt Execution","description":"Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-10-18","modified":"2023-02-04","tags":["attack.discovery","attack.t1526","attack.t1087","attack.t1083"],"technique_ids":["T1083","T1087","T1526"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://github.com/GhostPack/Seatbelt","https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_seatbelt.yml","source_sha256":"8bba00219aff3ee68d08213514204f9cd540dcb1a9e3191151b68a76af5b5fbb","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_seatbelt.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - Seatbelt Execution\nid: 38646daa-e78f-4ace-9de0-55547b2d30da\nstatus: test\ndescription: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters\nreferences:\n    - https://github.com/GhostPack/Seatbelt\n    - https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-10-18\nmodified: 2023-02-04\ntags:\n    - attack.discovery\n    - attack.t1526\n    - attack.t1087\n    - attack.t1083\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\Seatbelt.exe'\n        - OriginalFileName: 'Seatbelt.exe'\n        - Description: 'Seatbelt'\n        - CommandLine|contains:\n              # This just a list of the commands that will produce the least amount of FP in \"theory\"\n              # Comment out/in as needed in your environment\n              # To get the full list of commands see reference section\n              - ' DpapiMasterKeys'\n              - ' InterestingProcesses'\n              - ' InterestingFiles'\n              - ' CertificateThumbprints'\n              - ' ChromiumBookmarks'\n              - ' ChromiumHistory'\n              - ' ChromiumPresence'\n              - ' CloudCredentials'\n              - ' CredEnum'\n              - ' CredGuard'\n              - ' FirefoxHistory'\n              - ' ProcessCreationEvents'\n              # - ' RDPSessions'\n              # - ' PowerShellHistory'\n    selection_group_list:\n        CommandLine|contains:\n            - ' -group=misc'\n            - ' -group=remote'\n            - ' -group=chromium'\n            - ' -group=slack'\n            - ' -group=system'\n            - ' -group=user'\n            - ' -group=all'\n    selection_group_output:\n        CommandLine|contains: ' -outputfile='\n    condition: selection_img or all of selection_group_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1083","id":"T1083","name":"File and Directory Discovery","page":"techniques/enterprise/T1083/"},{"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","page":"techniques/enterprise/T1087/"},{"key":"enterprise/T1526","id":"T1526","name":"Cloud Service Discovery","page":"techniques/enterprise/T1526/"}],"data_path":"data/detection-rules/38646daa-e78f-4ace-9de0-55547b2d30da.json","kind":"sigma"}