Sigma rule: Insensitive Subfolder Search Via Findstr.EXE

Rule

Title

Insensitive Subfolder Search Via Findstr.EXE

Status

test

Level

low

Author

Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)

Date

2020-10-05

Modified

2024-03-05

File

rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Log source

product

windows

category

process_creation

Detection

selection_findstr:
    - CommandLine|contains: findstr
    - Image|endswith: 'findstr.exe'
    - OriginalFileName: 'FINDSTR.EXE'
selection_cli_search_subfolder:
    CommandLine|contains|windash: ' -s '
selection_cli_search_insensitive:
    CommandLine|contains|windash: ' -i '
condition: selection_findstr and all of selection_cli_search_*

False positives (as the rule lists them)

• Administrative or software activity

Tags

• attack.credential-access
• attack.command-and-control
• attack.stealth
• attack.t1218
• attack.t1564.004
• attack.t1552.001
• attack.t1105

MITRE ATT&CK ids this rule names

• T1105
• T1218
• T1552.001
• T1564.004

Related rules

• bf6c39fc-e203-45b9-9538-05397c1b4f3f (obsolete)

References

• https://lolbas-project.github.io/lolbas/Binaries/Findstr/
• https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
• https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml