HackTool - SILENTTRINITY Stager Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•15

This rule detects the execution of a SILENTTRINITY stager by looking for the string 'st2stager' within the 'Description' field of process creation events. This string is typically found in the PE metadata of the stager executable, indicating its use.