Seatbelt · Pentesting Tools

What is it?

Seatbelt is a C# host survey tool that performs a wide range of security checks on a Windows system. Unlike tools that focus solely on privilege escalation (like SharpUp or PowerUp), Seatbelt gives you a complete picture of the machine: what defenses are in place, what credentials might be accessible, what the user environment looks like, and yes, what escalation paths exist.

Think of it as the Windows equivalent of running 30+ manual enumeration commands in one shot. It checks:

Security posture: Is Credential Guard enabled? What AV is running? Is LSASS protected?
Token privileges: Does your user have SeImpersonatePrivilege? SeBackupPrivilege?
Credential locations: Saved RDP connections, browser bookmarks, recent files, credential files
System info: Installed patches, .NET versions, PowerShell history, environment variables
Interesting files: Config files, backup files, scripts with credentials

Run this first

Run every check group and save the output, since the full output is large.

cmd: your first survey

C:\> Seatbelt.exe -group=all -full > C:\Users\jsmith\seatbelt.txt

-group=all runs every check Seatbelt has.
-full includes details that the default output summarizes.

Read PowerShellHistory first, since admins type passwords into PowerShell commands often enough that this single check is frequently the most valuable. On a slow connection, run a targeted group instead of -group=all, since the full output is large.

When do you use it?

Seatbelt should be one of the first things you run after getting a shell on a Windows machine. It's your reconnaissance tool for the local host.

Run Seatbelt when

You just got a shell: run it immediately to understand what you're working with
Before trying privesc: it tells you what defenses are in place (Credential Guard, LSASS protection, AV)
Before running Mimikatz: check if Credential Guard is on (Mimikatz won't work) or if LSASS RunAsPPL is set
Looking for credential locations: finds where creds might be stored on this machine
Assessing a machine's value: is this a regular workstation or does it have interesting software/connections?

Key command groups

Run everything

cmd: run all checks

# Run every check: produces a lot of output but nothing is missed
C:\> Seatbelt.exe -group=all

# Same but full output (no truncation of long results)
C:\> Seatbelt.exe -group=all -full

# Save to file (the output is huge, redirect it)
C:\> Seatbelt.exe -group=all -full > C:\Users\jsmith\seatbelt.txt

Focused groups

cmd: targeted groups

# User-level checks (doesn't need admin)
C:\> Seatbelt.exe -group=user
# Checks: browser data, clipboard, recent files, saved RDP, environment vars,
# credential files, token privileges, idle time, PowerShell history

# System-level checks (needs admin for some)
C:\> Seatbelt.exe -group=system
# Checks: AV config, Credential Guard, LSASS config, firewall rules,
# installed patches, autorun entries, local users/groups

# Miscellaneous checks
C:\> Seatbelt.exe -group=misc
# Checks: interesting files, process info, logged-on users, network shares

Group	Needs admin?	What it covers
`-group=user`	No	Current user's environment, saved creds, browser data, tokens
`-group=system`	Some checks	OS info, AV, Credential Guard, patches, firewall, services
`-group=misc`	Some checks	Interesting files, processes, network, logged-on users
`-group=all`	Some checks	Everything above combined

Important individual checks

You can run specific checks instead of entire groups. These are the ones that matter most:

cmd: critical individual checks

# Check if Credential Guard is enabled (blocks Mimikatz)
C:\> Seatbelt.exe CredGuard

# Check token privileges (SeImpersonate = potato attacks possible)
C:\> Seatbelt.exe TokenPrivileges

# Find interesting files (configs, passwords, backups)
C:\> Seatbelt.exe InterestingFiles

# Check saved RDP connections (shows which servers users connect to)
C:\> Seatbelt.exe RDPSavedConnections

# PowerShell command history (might contain passwords typed in commands)
C:\> Seatbelt.exe PowerShellHistory

# Check AV status
C:\> Seatbelt.exe AntiVirus

# LSASS protection status (RunAsPPL blocks Mimikatz)
C:\> Seatbelt.exe LSASettings

# Combine multiple specific checks
C:\> Seatbelt.exe CredGuard TokenPrivileges LSASettings AntiVirus

Decision-making from Seatbelt output

CredGuard = enabled → Mimikatz will NOT work for LSASS dumping. Use other credential sources (LaZagne, SessionGopher, registry secrets)
SeImpersonatePrivilege = enabled → Potato attacks will work for SYSTEM escalation
LSA RunAsPPL = 1 → LSASS is protected. Mimikatz needs a driver or you need to find another way
PowerShellHistory not empty → Check it for passwords, connection strings, or commands that reveal infrastructure
RDPSavedConnections present → These servers are valuable targets. Cross-reference with SessionGopher for saved passwords
InterestingFiles hits → Check each one manually. Config files, .bak files, and scripts often contain hardcoded credentials

Reading the output

output: example Seatbelt results

====== CredGuard ======
  CredentialGuard         : Not enabled                <-- Mimikatz will work!

====== TokenPrivileges ======
  Current Token Privileges:
    SeImpersonatePrivilege  : SE_PRIVILEGE_ENABLED     <-- Potato attacks!
    SeChangeNotifyPrivilege : SE_PRIVILEGE_ENABLED
    SeIncreaseWorkingSetPrivilege : SE_PRIVILEGE_ENABLED

====== AntiVirus ======
  Engine                  : Windows Defender
  ProductState            : On

====== LSASettings ======
  RunAsPPL                : 0                          <-- LSASS not protected

====== PowerShellHistory ======
  C:\Users\jsmith\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
  net use \\fileserver\share /user:admin P@ssw0rd2024   <-- Password in history!
  Get-ADUser -Filter *
  Invoke-WebRequest http://intranet.corp.local/report

====== RDPSavedConnections ======
  jsmith :
    DC01.corp.local                                      <-- User RDPs to DC!
    FILESERVER01.corp.local
    SQL01.corp.local

The output prioritization workflow

When facing a wall of Seatbelt output, read in this order: 1) TokenPrivileges: quick wins like SeImpersonate. 2) CredGuard / LSASettings: determines if Mimikatz will work. 3) PowerShellHistory: plaintext passwords in commands. 4) InterestingFiles: configs and backups. 5) RDPSavedConnections: maps the admin's infrastructure. Everything else is context.

Seatbelt vs winPEAS

Feature	Seatbelt	winPEAS
Focus	Host survey: broad security assessment	Privilege escalation: focused on getting admin/SYSTEM
Language	C# (.NET)	C# (.NET) or batch
Output	Structured, clean sections	Color-coded by severity (red/yellow/green)
Defense checks	Detailed (CredGuard, LSASS, AV status)	Basic mention
Credential hunting	Shows locations but doesn't extract	Tries to flag and sometimes extract
Privesc coverage	Token privs, basic service checks	Comprehensive: services, scheduled tasks, registry, paths
Best for	Initial host assessment + defense mapping	Finding escalation paths specifically

Use both

Seatbelt tells you the lay of the land, what defenses exist and what the machine looks like. winPEAS tells you how to escalate. Run Seatbelt first to know what you're dealing with, then winPEAS to find the privesc path.

Common mistakes

Things that go wrong

Skipping it because you already ran winPEAS: Seatbelt finds things winPEAS doesn't, defense posture, PowerShell history, credential locations. They're complementary
Not reading PowerShellHistory: This is often the single most valuable check. Admins type passwords in PowerShell commands constantly
Not checking CredGuard before Mimikatz: If Credential Guard is enabled, Mimikatz will fail. Check first and save yourself the detection risk
Running -group=all on a slow connection: Full Seatbelt output is massive. On a slow shell, run targeted groups or pipe to a file on disk and then exfiltrate it
Ignoring the "boring" sections: Installed software, .NET versions, and environment variables can reveal attack surface you'd otherwise miss, a vulnerable application, a debug variable with a password, etc.

Related tools

winPEAS

Focused privesc enumeration. Run after Seatbelt to find escalation paths.

SharpUp

Checks exploitable service misconfigurations. More targeted than Seatbelt for service-based privesc.

PowerUp

PowerShell privesc finder with auto-exploitation. Good when you have PowerShell access.

Mimikatz

Check Seatbelt's CredGuard and LSASettings before running, they determine if Mimikatz will work.

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.

You already ran winPEAS. Is Seatbelt worth running too?

Yes. They are complementary: Seatbelt covers defense posture, PowerShell history and credential locations that winPEAS does not check.

Which single check is often the most valuable, and why?

PowerShellHistory. Administrators frequently type passwords directly into PowerShell commands.

Before running Mimikatz on a target, which Seatbelt check should you look at first?

Whether Credential Guard is enabled. If it is, Mimikatz fails outright, so check first rather than risk the detection for nothing.

Why is -group=all -full a poor choice on a slow shell?

The output is large, so it can take a long time to transfer. Run a targeted group, or pipe to a file and exfiltrate that instead.

Why not skip the "boring" sections like installed software and environment variables?

They can reveal attack surface you'd otherwise miss, such as a vulnerable installed application or a debug environment variable holding a password.