Windows Process Execution of findstr.EXE for Security Tool Keyword Filtering
Alerts on Windows findstr.exe executions that filter output using security software and antivirus-related keywords.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-10-20
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions of findstr.exe (including find.exe and findstr.exe image/original filename variants) where the command line ends with specific security tool and antivirus-related keywords. Attackers commonly use findstr to filter recon output (for example, narrowing results from commands that enumerate local users, processes, or system details) to surface security-relevant information. The detection relies on process creation telemetry, matching the executed binary name and the command-line suffix keywords indicative of security software discovery and filtering behavior.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- hhs.govhttps://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution of findstr.EXE for Security Tool Keyword Filtering
id: 591d2d8c-1231-4da4-8e27-06509814d90c
related:
- id: fe63010f-8823-4864-a96b-a7b4a0f7b929
type: derived
- id: 4fe074b4-b833-4081-8f24-7dcfeca72b42
type: derived
status: test
description: This rule flags Windows process executions of findstr.exe (including find.exe and findstr.exe image/original filename variants) where the command line ends with specific security tool and antivirus-related keywords. Attackers commonly use findstr to filter recon output (for example, narrowing results from commands that enumerate local users, processes, or system details) to surface security-relevant information. The detection relies on process creation telemetry, matching the executed binary name and the command-line suffix keywords indicative of security software discovery and filtering behavior.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery
- https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2023-10-20
modified: 2023-11-14
tags:
- attack.discovery
- attack.t1518.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \find.exe
- \findstr.exe
- OriginalFileName:
- FIND.EXE
- FINDSTR.EXE
selection_cli:
CommandLine|endswith:
- " avira"
- ' avira"'
- " cb"
- ' cb"'
- " cylance"
- ' cylance"'
- " defender"
- ' defender"'
- " kaspersky"
- ' kaspersky"'
- " kes"
- ' kes"'
- " mc"
- ' mc"'
- " sec"
- ' sec"'
- " sentinel"
- ' sentinel"'
- " symantec"
- ' symantec"'
- " virus"
- ' virus"'
condition: all of selection_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/info.yml
simulation:
- type: atomic-red-team
name: Security Software Discovery
technique: T1518.001
atomic_guid: f92a380f-ced9-491f-b338-95a991418ce2
license: DRL-1.1