Windows findstr.exe Password Keyword Search in Multiple Languages

title: Windows findstr.exe Password Keyword Search in Multiple Languages
id: 91a0809f-3077-4c4a-a938-c1efba686955
status: test
description: This rule identifies Windows process executions where findstr.exe is used to search for the keyword "passwords" (or language-specific equivalents) in command-line arguments. Attackers may use this kind of text search to quickly locate credential material in files or script outputs during credential access attempts. The detection relies on process creation telemetry, specifically the image path (findstr.exe) and the command line containing any of the listed multilingual keyword fragments.
references:
  - https://steflan-security.com/windows-privilege-escalation-credential-harvesting/
  - https://adsecurity.org/?p=2288
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_findstr_password_recon.yml
author: Josh Nickels, Huntrule Team
date: 2023-05-18
tags:
  - attack.credential-access
  - attack.t1552.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \findstr.exe
    - OriginalFileName: FINDSTR.EXE
  selection_cli:
    CommandLine|contains:
      - contraseña
      - hasło
      - heslo
      - parola
      - passe
      - passw
      - senha
      - senord
      - 密碼
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1a0f6f16-2099-4753-9a02-43b6ac7a1fa5
    type: derived