Sigma rule: Recon Command Output Piped To Findstr.EXE

Rule

Title

Recon Command Output Piped To Findstr.EXE

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems), frack113

Date

2023-07-06

Modified

2025-10-08

File

rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.

Log source

product

windows

category

process_creation

Detection

selection:
    CommandLine|contains:
        # Note: Add additional CLI to increase and enhance coverage
        # Note: We use wildcards in this instance to avoid writing a lot of variations that can be avoided easily. You can switch to regex if its supported by your backend.
        - 'ipconfig*|*find'
        - 'net*|*find'
        - 'netstat*|*find'
        - 'ping*|*find'
        - 'systeminfo*|*find'
        - 'tasklist*|*find'
        - 'whoami*|*find'
filter_optional_xampp:
    CommandLine|contains|all:
        - 'cmd.exe /c TASKLIST /V |'
        - 'FIND /I'
        - '\xampp\'
        - '\catalina_start.bat'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.discovery
• attack.t1057

MITRE ATT&CK ids this rule names

• T1057

Related rules

• fe63010f-8823-4864-a96b-a7b4a0f7b929 (derived)

References

• https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1057/T1057.md#atomic-test-6---discover-specific-process---tasklist
• https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf
• https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml