Possible Insensitive Subfolder Search Through Findstr.EXE (via process_creation)

title: Possible Insensitive Subfolder Search Through Findstr.EXE (via process_creation)
id: 199e1452-6e9a-569e-8476-e0f646055998
status: stable
description: This rule detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Adversaries sometimes abuse this built-in utility to search the system for interesting files or filter through results of commands.
references:
    - https://attack.mitre.org/techniques/T1105/
    - https://attack.mitre.org/techniques/T1552/001/
    - https://attack.mitre.org/techniques/T1564/004/
    - https://attack.mitre.org/techniques/T1218/
    - https://lolbas-project.github.io/lolbas/Binaries/Findstr/
    - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
    - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
author: Huntrule Team
date: 2026-03-27
tags:
    - attack.credential-access
    - attack.command-and-control
    - attack.stealth
    - attack.t1218
    - attack.t1564.004
    - attack.t1552.001
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_findstr:
        - CommandLine|contains: findstr
        - Image|endswith: 'findstr.exe'
        - OriginalFileName: 'FINDSTR.EXE'
    selection_cli_search_subfolder:
        CommandLine|contains|windash: ' -s '
    selection_cli_search_insensitive:
        CommandLine|contains|windash: ' -i '
    condition: selection_findstr and all of selection_cli_search_*
falsepositives:
    - Unknown
level: low