Suspicious Security Utilities Keyword Lookup Through Findstr.EXE (via process_creation)

title: Suspicious Security Utilities Keyword Lookup Through Findstr.EXE (via process_creation)
id: 0ad1457b-556e-5b61-9c62-11e9263e293f
status: stable
description: This rule detects execution of "findstr" to search for common names of security tools. Adversaries frequently pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" to filter out the results. This detection focuses on the keywords that the adversary might use as a filter.
references:
    - https://attack.mitre.org/techniques/T1518/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery
    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
    - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf
author: Huntrule Team
date: 2026-03-28
tags:
    - attack.discovery
    - attack.t1518.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\find.exe'
              - '\findstr.exe'
        - OriginalFileName:
              - 'FIND.EXE'
              - 'FINDSTR.EXE'
    selection_cli:
        CommandLine|endswith:
            - ' avira'
            - ' avira"'
            - ' cb'
            - ' cb"'
            - ' cylance'
            - ' cylance"'
            - ' defender'
            - ' defender"'
            - ' kaspersky'
            - ' kaspersky"'
            - ' kes'
            - ' kes"'
            - ' mc'
            - ' mc"'
            - ' sec'
            - ' sec"'
            - ' sentinel'
            - ' sentinel"'
            - ' symantec'
            - ' symantec"'
            - ' virus'
            - ' virus"'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/info.yml
simulation:
    - type: atomic-red-team
      name: Security Software Discovery
      technique: T1518.001
      atomic_guid: f92a380f-ced9-491f-b338-95a991418ce2