Windows Process Creation: findstr.exe Searches for 'passwords' Keywords in Multiple Languages

Flags findstr.exe command lines searching password keywords across multiple languages.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_creation
Author: Josh Nickels (SigmaHQ), DRL 1.1
Published: 2023-05-18
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies command-line executions of findstr.exe where the command line contains language-specific keywords associated with passwords. Attackers may use built-in search utilities to quickly locate credential-related text within files or content. The detection relies on Windows process creation telemetry, specifically the executable path/name and the full command line text.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious Access to Cloud and Database Credential Files via Process

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Malicious Winlogon Automatic Logon Persistence via Registry AutoAdminLogon (via process_creation)

Suspicious RegAsm MSBuild or AutoIt Accessing Browser Credential Stores

Windows Process Creation: findstr.exe Searches for 'passwords' Keywords in Multiple Languages

Pivot detection · T1552.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-findstr-exe-password-keyword-search-in-multiple-languages-1a0f6f16

title: "Windows Process Creation: findstr.exe Searches for 'passwords' Keywords in Multiple Languages"
id: 91a0809f-3077-4c4a-a938-c1efba686955
status: test
description: This rule identifies command-line executions of findstr.exe where the command line contains language-specific keywords associated with passwords. Attackers may use built-in search utilities to quickly locate credential-related text within files or content. The detection relies on Windows process creation telemetry, specifically the executable path/name and the full command line text.
references:
  - https://steflan-security.com/windows-privilege-escalation-credential-harvesting/
  - https://adsecurity.org/?p=2288
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_findstr_password_recon.yml
author: Josh Nickels, Huntrule Team
date: 2023-05-18
tags:
  - attack.credential-access
  - attack.t1552.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \findstr.exe
    - OriginalFileName: FINDSTR.EXE
  selection_cli:
    CommandLine|contains:
      - contraseña
      - hasło
      - heslo
      - parola
      - passe
      - passw
      - senha
      - senord
      - 密碼
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1a0f6f16-2099-4753-9a02-43b6ac7a1fa5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL