Suspicious Remote File Download Through Findstr.EXE (via process_creation)

title: Suspicious Remote File Download Through Findstr.EXE (via process_creation)
id: 07efe295-7afc-5acc-95b9-b186ca078699
status: stable
description: This rule detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would enable "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
references:
    - https://attack.mitre.org/techniques/T1105/
    - https://attack.mitre.org/techniques/T1552/001/
    - https://attack.mitre.org/techniques/T1564/004/
    - https://attack.mitre.org/techniques/T1218/
    - https://lolbas-project.github.io/lolbas/Binaries/Findstr/
    - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
    - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
author: Huntrule Team
date: 2026-04-11
tags:
    - attack.credential-access
    - attack.command-and-control
    - attack.stealth
    - attack.t1218
    - attack.t1564.004
    - attack.t1552.001
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_findstr:
        - CommandLine|contains: findstr
        - Image|endswith: 'findstr.exe'
        - OriginalFileName: 'FINDSTR.EXE'
    selection_cli_download_1:
        CommandLine|contains|windash: ' -v '
    selection_cli_download_2:
        CommandLine|contains|windash: ' -l '
    selection_cli_download_3:
        CommandLine|contains: '\\\\'
    condition: selection_findstr and all of selection_cli_download_*
falsepositives:
    - Unknown
level: medium