Sigma rule: Remote File Download Via Findstr.EXE

Rule

Title

Remote File Download Via Findstr.EXE

Status

test

Level

medium

Author

Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)

Date

2020-10-05

Modified

2024-03-05

File

rules/windows/process_creation/proc_creation_win_findstr_download.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Log source

product

windows

category

process_creation

Detection

selection_findstr:
    - CommandLine|contains: findstr
    - Image|endswith: 'findstr.exe'
    - OriginalFileName: 'FINDSTR.EXE'
selection_cli_download_1:
    CommandLine|contains|windash: ' -v '
selection_cli_download_2:
    CommandLine|contains|windash: ' -l '
selection_cli_download_3:
    CommandLine|contains: '\\\\'
condition: selection_findstr and all of selection_cli_download_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.command-and-control
• attack.stealth
• attack.t1218
• attack.t1564.004
• attack.t1552.001
• attack.t1105

MITRE ATT&CK ids this rule names

• T1105
• T1218
• T1552.001
• T1564.004

Related rules

• bf6c39fc-e203-45b9-9538-05397c1b4f3f (obsolete)

References

• https://lolbas-project.github.io/lolbas/Binaries/Findstr/
• https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
• https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_findstr_download.yml