Seatbelt Overview - SpecterOps Open Source

What is Seatbelt?

Seatbelt is a C# project that performs security-oriented host-survey “safety checks” on Windows systems. It collects a comprehensive set of system information useful from both offensive and defensive security perspectives.

Seatbelt was inspired by @andrewchiles’ HostEnum.ps1 and @tifkin_’s Get-HostProfile.ps1.

Key Features

120+ Enumeration Commands

Comprehensive host enumeration covering system, user, and security configurations

Command Groups

Organized command groups for targeted enumeration (system, user, misc, remote)

Remote Enumeration

Enumerate remote systems via WMI with alternate credentials

Flexible Output

Text or JSON output formats with configurable verbosity

Modular Architecture

Easily extensible with custom command modules

Privilege Context Aware

Automatically adjusts enumeration scope based on current privileges

Command Groups

Seatbelt organizes its 120+ commands into logical groups for targeted enumeration:

System Group

Runs checks that mine interesting data about the system itself.

System Commands (50+ checks)

OS & Environment: OSInfo, DotNet, EnvironmentVariables, EnvironmentPath, LastShutdownSecurity Configuration: AppLocker, UAC, LAPS, CredGuard, SecureBoot, WindowsDefenderAuthentication: NTLM Settings, LSA Settings, Audit Policies, Token PrivilegesNetwork: ARP Table, TCP/UDP Connections, DNS Cache, Network Shares, Network Profiles, RDP SettingsMonitoring: Sysmon, Windows Defender, Windows Event Forwarding, AMSI ProvidersLocal Objects: Local Users, Local Groups, Services, Processes, Scheduled Tasks, Named PipesEnterprise: SCCM, WSUS, Windows Firewall, Hotfixes

Usage: Seatbelt.exe -group=system

User Group

Runs checks that enumerate user-specific data and credentials.

User Commands (30+ checks)

Credentials: CredEnum, DPAPI Master Keys, Windows Vault, Security Package CredentialsBrowser Data: Chromium (Chrome/Edge/Brave/Opera), Firefox files and historyCloud Credentials: AWS, Google, Azure, Bluemix credential filesRecent Activity: Explorer MRUs, Explorer Run Commands, Office MRUs, IE URLsSaved Connections: FileZilla, PuTTY, SuperPuTTY, RDC Manager, RDP Saved ConnectionsCertificates: User and machine personal certificate filesOther: Mapped Drives, Token Groups, KeePass, OneNote, PowerShell History, Slack files

Usage: Seatbelt.exe -group=user

User commands run for the current user if not elevated, and for ALL users if elevated.

Misc Group

Miscellaneous enumeration commands that take longer to run or serve specific purposes.

Misc Commands (20+ checks)

Event Logs: Logon Events, Explicit Logon Events, Process Creation Events, PowerShell Events, Sysmon EventsTime-Intensive: Interesting Files, LOLBAS, Search IndexDetailed Analysis: File Info, Registry Query, Recycle BinSystem Details: Installed Products, Microsoft Updates, Printers, RPC Endpoints, Scheduled Tasks

Usage: Seatbelt.exe -group=misc

Browser Groups

Specialized groups for browser enumeration.

Chromium
Slack

Enumerates Chrome, Edge, Brave, and Opera artifacts:

ChromiumPresence
ChromiumBookmarks
ChromiumHistory

Usage: Seatbelt.exe -group=chromium

Remote Group

Subset of commands that support remote enumeration via WMI (marked with + in help).

Remote-Capable Commands (40+ checks)

Commands that can be executed against remote systems include most system and user checks that rely on WMI and registry access.Examples: AMSIProviders, AntiVirus, DotNet, Hotfixes, LocalUsers, LogonEvents, PowerShell, WindowsDefender, and more.

Usage: Seatbelt.exe -group=remote -computername=HOST [-username=DOMAIN\USER -password=PASSWORD]

Command Execution Options

Running Individual Commands

# Single command
Seatbelt.exe OSInfo

# Multiple commands
Seatbelt.exe OSInfo LocalUsers AntiVirus

# Command with full output (no filtering)
Seatbelt.exe Processes -full

Running Command Groups

# All system checks
Seatbelt.exe -group=system

# All checks with full output
Seatbelt.exe -group=all -full

# All checks except specific commands
Seatbelt.exe -group=all -AuditPolicies -Hotfixes

Commands with Arguments

Some commands accept arguments (enclosed in quotes):

# Logon events for last 30 days
Seatbelt.exe "LogonEvents 30"

# Directory listing with depth and regex
Seatbelt.exe "dir C:\Users 3 .*password.* false"

# Registry query with depth and regex
Seatbelt.exe "reg \"HKLM\SOFTWARE\Microsoft\Windows Defender\" 3 .*defini.* true"

Remote Enumeration

Commands marked with + in the help menu support remote execution via WMI.

Basic Remote Execution

Specify target computer with -computername:

Seatbelt.exe OSInfo -computername=192.168.1.100

Authenticated Remote Execution

Provide alternate credentials:

Seatbelt.exe -group=remote -computername=DC01.domain.com -username=DOMAIN\user -password="P@ssw0rd"

Remote Command Groups

Use the remote group for optimized remote enumeration:

Seatbelt.exe -group=remote -computername=TARGET

Remote Execution Architecture

Remote enumeration requires:

Network access to target on WMI ports (135/TCP, dynamic RPC)
Appropriate permissions on target system
WMI and Remote Registry services running

Output Options

Text Output

Default output format to console or file:

# Console output
Seatbelt.exe -group=system

# Text file output
Seatbelt.exe -group=system -outputfile="C:\Temp\results.txt"

JSON Output

Structured output for parsing and automation:

# JSON file output (file extension must be .json)
Seatbelt.exe -group=user -outputfile="C:\Temp\results.json"

# Quiet mode (no console output)
Seatbelt.exe -group=user -q -outputfile="C:\Temp\results.json"

Output Verbosity

# Default (filtered output)
Seatbelt.exe Processes

# Full output (no filtering)
Seatbelt.exe Processes -full

# Quiet mode (no console messages)
Seatbelt.exe -group=user -q -outputfile="output.json"

Privilege Context Behavior

Seatbelt automatically adjusts its behavior based on execution context:

Not Elevated
Elevated (Admin)
High Integrity

User Commands: Enumerate current user onlySystem Commands: Limited to non-privileged enumerationTypical Use: Initial reconnaissance on compromised user account

Modular Architecture

Seatbelt’s structure is completely modular for easy extension:

Command Template

Use the template at .\Seatbelt\Commands\Template.cs as a starting point

Implement Command

Create your command class inheriting from CommandBase

Add to Project

Place in appropriate directory and include in Visual Studio solution

Compile

Rebuild project - new command automatically discovered and loaded

Use Cases

Red Team Operations

Post-compromise situational awareness and privilege escalation enumeration

Penetration Testing

Host-based enumeration during internal assessments

Incident Response

Rapid triage and forensic artifact collection

Security Auditing

Baseline security configuration assessment

Threat Hunting

Anomaly detection and security posture evaluation

Blue Team Testing

Validate detection capabilities and log visibility

Detection Considerations

Seatbelt generates significant detection opportunities for defenders.

Detection Indicators

Process Indicators:

Process name: Seatbelt.exe (or renamed executable)
Unusual .NET assembly loading patterns
Sequential enumeration of multiple system resources

Behavioral Indicators:

Rapid WMI queries across multiple classes
Extensive registry enumeration
File system searches for specific patterns
Event log queries for security events
Network connection enumeration

Network Indicators (Remote Mode):

WMI connections to remote systems (135/TCP, RPC)
StdRegProv registry access patterns
Authenticated connections with unusual source

Defensive Measures

Detection Strategies

Monitor for processes making numerous WMI queries
Alert on registry enumeration of sensitive keys (LSA, credential locations)
Track event log access patterns (especially security log)
Monitor file access to credential-related files
Detect sequential execution of enumeration activities
Signature-based detection of Seatbelt binary

Prevention Strategies

Implement least privilege to reduce enumeration effectiveness
Harden credential storage and remove cached credentials
Enable constrained PowerShell language mode
Implement application whitelisting (AppLocker, WDAC)
Restrict WMI access and remote registry
Enable enhanced logging for enumeration activities

Command Summary Statistics

System Commands

50+ checksOS, security, network, and system configuration

User Commands

30+ checksUser data, credentials, and activity

Misc Commands

20+ checksEvent logs, intensive searches, detailed analysis

Browser Commands

6 checksChromium and Firefox artifacts

Remote-Capable

40+ checksCommands supporting WMI-based remote execution

Total Commands

120+ checksComprehensive Windows host enumeration

Quick Start

Basic Enumeration

Run all checks:

Seatbelt.exe -group=all

Targeted Enumeration

Run specific command group:

Seatbelt.exe -group=system

Save Results

Output to file:

Seatbelt.exe -group=all -outputfile="C:\Temp\results.json"

Remote Enumeration

Enumerate remote system:

Seatbelt.exe -group=remote -computername=TARGET -username=DOMAIN\USER -password=PASS

Example Output

                        %&&@@@&&
                        &&&&&&&%%%,                       #&&@@@@@@%%%%%%###############%
                        &%&   %&%%                        &////(((&%%%%%#%################//((((###%%%%%%%%%%%%%%%
%%%%%%%%%%%######%%%#%%####%  &%%**#                      @////(((&%%%%%%######################(((((((((((((((((((
#%#%%%%%%%#######%#%%#######  %&%,,,,,,,,,,,,,,,,         @////(((&%%%%%#%#####################(((((((((((((((((((
#%#%%%%%%#####%%#%#%%#######  %%%,,,,,,  ,,.   ,,         @////(((&%%%%%%%######################(#(((#(#((((((((((
#####%%%####################  &%%......  ...   ..         @////(((&%%%%%%%###############%######((#(#(####((((((((
#######%##########%#########  %%%......  ...   ..         @////(((&%%%%%#########################(#(#######((#####
###%##%%####################  &%%...............          @////(((&%%%%%%%%##############%#######(#########((#####
#####%######################  %%%..                       @////(((&%%%%%%%################
                        &%&   %%%%%      Seatbelt         %////(((&%%%%%%%%#############*
                        &%%&&&%%%%%        v1.2.1         ,(((&%%%%%%%%%%%%%%%%%,
                         #%%%%##,


Available commands (+ means remote usage is supported):
...

[*] Running System Checks...

=== OSInfo ===
  Hostname                :  WORKSTATION01
  Domain                  :  CORP.LOCAL
  OS Version              :  Microsoft Windows 10 Pro (10.0.19045)
  Architecture            :  x64
  Hotfixes Applied        :  KB5012345, KB5012346, KB5012347

Additional Resources

GitHub Repository

Official Seatbelt repository

Compilation Guide

Build Seatbelt from source

Usage Guide

Detailed usage examples and scenarios

GhostPack Tools

Other GhostPack security tools

Authors

Seatbelt is developed by @harmj0y and @tifkin_.

License

Seatbelt is licensed under the BSD 3-Clause license.

Getting Started

System - OS & Environment

System - Security Configuration

System - Authentication & Access

System - Network

System - Monitoring & Enterprise

System - Advanced

User - Credentials

User - Browser Data

User - Cloud & Remote Access

User - Recent Activity

User - Communication

Misc - Event Logs

Misc - Browser History

Misc - File & Registry

Misc - System Details

​What is Seatbelt?

​Key Features

120+ Enumeration Commands

Command Groups

Remote Enumeration

Flexible Output

Modular Architecture

Privilege Context Aware

​Command Groups

​System Group

​User Group

​Misc Group

​Browser Groups

​Remote Group

​Command Execution Options

​Running Individual Commands

​Running Command Groups

​Commands with Arguments

​Remote Enumeration

​Remote Execution Architecture

​Output Options

​Text Output

​JSON Output

​Output Verbosity

​Privilege Context Behavior

​Modular Architecture

​Use Cases

Red Team Operations

Penetration Testing

Incident Response

Security Auditing

Threat Hunting

Blue Team Testing

​Detection Considerations

​Detection Indicators

​Defensive Measures

​Command Summary Statistics

System Commands

User Commands

Misc Commands

Browser Commands

Remote-Capable

Total Commands

​Quick Start

​Example Output

​Additional Resources

GitHub Repository

Compilation Guide

Usage Guide

GhostPack Tools

​Authors

​License

What is Seatbelt?

Key Features

Command Groups

System Group

User Group

Misc Group

Browser Groups

Remote Group

Command Execution Options

Running Individual Commands

Running Command Groups

Commands with Arguments

Remote Enumeration

Remote Execution Architecture

Output Options

Text Output

JSON Output

Output Verbosity

Privilege Context Behavior

Modular Architecture

Use Cases

Detection Considerations

Detection Indicators

Defensive Measures

Command Summary Statistics

Quick Start

Example Output

Additional Resources

Authors

License