Possible Permission Misconfiguration Recon Through Findstr.EXE (via process_creation)

title: Possible Permission Misconfiguration Recon Through Findstr.EXE (via process_creation)
id: c6ad13ac-769b-5d10-8f7b-027f9f29cbac
status: stable
description: This rule detects use of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
references:
    - https://attack.mitre.org/techniques/T1552/006/
    - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
author: Huntrule Team
date: 2026-06-29
tags:
    - attack.credential-access
    - attack.t1552.006
logsource:
    category: process_creation
    product: windows
detection:
    selection_findstr_img:
        - Image|endswith:
              - '\find.exe'
              - '\findstr.exe'
        - OriginalFileName:
              - 'FIND.EXE'
              - 'FINDSTR.EXE'
    selection_findstr_cli:
        CommandLine|contains:
            - '"Everyone"'
            - "'Everyone'"
            - '"BUILTIN\\"'
            - "'BUILTIN\\'"
    selection_special:
        CommandLine|contains|all:
            - 'icacls '
            - 'findstr '
            - 'Everyone'
    condition: all of selection_findstr_* or selection_special
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone/info.yml