Sigma rule: Permission Misconfiguration Reconnaissance Via Findstr.EXE

Rule

Title

Permission Misconfiguration Reconnaissance Via Findstr.EXE

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-08-12

Modified

2023-11-11

File

rules/windows/process_creation/proc_creation_win_findstr_recon_everyone.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.

Log source

product

windows

category

process_creation

Detection

selection_findstr_img:
    - Image|endswith:
          - '\find.exe'
          - '\findstr.exe'
    - OriginalFileName:
          - 'FIND.EXE'
          - 'FINDSTR.EXE'
selection_findstr_cli:
    CommandLine|contains:
        - '"Everyone"'
        - "'Everyone'"
        - '"BUILTIN\\"'
        - "'BUILTIN\\'"
selection_special:
    CommandLine|contains|all:
        # Example CLI would be: icacls "C:\Program Files\*" 2>nul | findstr "(M)" | findstr "Everyone"
        # You could extend it for other groups and users
        #   Example: icacls "C:\Program Files\*" 2>nul | findstr "(M)" | findstr "BUILTIN\Users"
        # Note: This selection only detects the command when executed from a handler such as a "cmd /c" or "powershell -c"
        - 'icacls '
        - 'findstr '
        - 'Everyone'
condition: all of selection_findstr_* or selection_special

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1552.006

MITRE ATT&CK ids this rule names

• T1552.006

References

• https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone.yml