timsonner Seatbelt
Purpose
Use this skill for targeted Windows host posture enumeration when the engagement includes approved access to a specific system.
Phase Fit
- Primary: Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure
Use When
- Need structured situational awareness of Windows security-relevant settings.
- Need to support privilege, credential, or hardening analysis on a host.
- Need a repeatable host-local retest after remediation.
Avoid When
- Host-local enumeration is not explicitly approved.
- Broad collection would exceed the current phase objective.
Inputs
- Approved Windows host and user context
- Output handling requirements
- Specific posture question or host review goal
Procedure
- Run only within the approved host scope.
- Focus on posture areas relevant to the current hypothesis.
- Correlate material findings with privilege or credential exposure.
- Record the exact host and collection scope used.
- Preserve the same scope for retest.
Command Syntax
Replace sample paths with the approved local binary path.
:: Run all checks
Seatbelt.exe -group=all
:: User-focused checks
Seatbelt.exe -group=user
:: System-focused checks
Seatbelt.exe -group=system
:: Run specific individual checks
Seatbelt.exe DotNet PowerShell Env
:: Quiet mode, all checks, output to file
Seatbelt.exe -q -group=all > C:\temp\seatbelt_output.txt
:: Remote system check
Seatbelt.exe -computername=10.10.10.100 -username=contoso\auditor -password='<password>' -group=system
Evidence to Capture
- Host posture issues that materially affect risk
- Exact host, user context, and collection scope used
- Minimal proof path needed for remediation
Safety Boundaries
- Use only on approved hosts.
- Keep collection aligned to the current hypothesis and protect host evidence.