Seatbelt Reconnaissance Tool Execution
Detects the execution of the reconnaissance tool Seatbelt. This rule identifies Seatbelt activity based on its executable name, original file name, description, and specific command-line arguments used for various discovery tasks, including DpapiMasterKeys, InterestingProcesses, InterestingFiles, CertificateThumbprints, Chromium data, CloudCredentials, CredEnum, CredGuard, FirefoxHistory, and ProcessCreationEvents. It also covers group-based commands like 'misc', 'remote', 'chromium', 'slack', 'system', 'user', and 'all', as well as output to a file.
Sigma
