PUA - Seatbelt Execution

Title: PUA - Seatbelt Execution
Status: test
Description:Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
References:
  -https://github.com/GhostPack/Seatbelt
  -https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-18
modified:2023-02-04
Tags:

• -'attack.discovery'
• -'attack.t1526'
• -'attack.t1087'
• -'attack.t1083'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\Seatbelt.exe' OriginalFileName:'Seatbelt.exe' Description:'Seatbelt'     - CommandLine|contains:
      - ' DpapiMasterKeys'
      - ' InterestingProcesses'
      - ' InterestingFiles'
      - ' CertificateThumbprints'
      - ' ChromiumBookmarks'
      - ' ChromiumHistory'
      - ' ChromiumPresence'
      - ' CloudCredentials'
      - ' CredEnum'
      - ' CredGuard'
      - ' FirefoxHistory'
      - ' ProcessCreationEvents'
  selection_group_list:
    CommandLine|contains:
      -' -group=misc'
      -' -group=remote'
      -' -group=chromium'
      -' -group=slack'
      -' -group=system'
      -' -group=user'
      -' -group=all'

  selection_group_output:
    CommandLine|contains: ' -outputfile='
  condition:selection_img or all of selection_group_*
Falsepositives:
  -Unlikely
Level: high