Windows Process Execution of findstr.EXE for Security Tool Keyword Filtering

Alerts on Windows findstr.exe executions that filter output using security software and antivirus-related keywords.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published: 2023-10-20
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1518.001Security Software Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process executions of findstr.exe (including find.exe and findstr.exe image/original filename variants) where the command line ends with specific security tool and antivirus-related keywords. Attackers commonly use findstr to filter recon output (for example, narrowing results from commands that enumerate local users, processes, or system details) to surface security-relevant information. The detection relies on process creation telemetry, matching the executed binary name and the command-line suffix keywords indicative of security software discovery and filtering behavior.

Reporting behind it

Related detections9 linkedT1518.001 — drag to rearrange

Antivirus Software Discovery via tasklist and findstr

Suspicious Security Software Discovery via WMI or Defender Query (via process_creation)

Suspicious Security Software Discovery via PowerShell SecurityCenter2 AntivirusProduct Query (via process_creation)

Suspicious Antivirus Product Enumeration via WMI Query via process_creation

Suspicious Security Software Discovery via tasklist and findstr (via process_creation)

Suspicious Security Process Enumeration via Tasklist And Findstr

Suspicious Security Software Enumeration on macOS

macOS csrutil Used to Disable System Integrity Protection (SIP)

macOS SIP Status Enumeration via csrutil status

Windows Process Execution of findstr.EXE for Security Tool Keyword Filtering

Pivot detection · T1518.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-findstr-exe-security-tool-keyword-lookup-via-command-line-4fe074b4

title: Windows Process Execution of findstr.EXE for Security Tool Keyword Filtering
id: 591d2d8c-1231-4da4-8e27-06509814d90c
related:
  - id: fe63010f-8823-4864-a96b-a7b4a0f7b929
    type: derived
  - id: 4fe074b4-b833-4081-8f24-7dcfeca72b42
    type: derived
status: test
description: This rule flags Windows process executions of findstr.exe (including find.exe and findstr.exe image/original filename variants) where the command line ends with specific security tool and antivirus-related keywords. Attackers commonly use findstr to filter recon output (for example, narrowing results from commands that enumerate local users, processes, or system details) to surface security-relevant information. The detection relies on process creation telemetry, matching the executed binary name and the command-line suffix keywords indicative of security software discovery and filtering behavior.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
  - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2023-10-20
modified: 2023-11-14
tags:
  - attack.discovery
  - attack.t1518.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \find.exe
        - \findstr.exe
    - OriginalFileName:
        - FIND.EXE
        - FINDSTR.EXE
  selection_cli:
    CommandLine|endswith:
      - " avira"
      - ' avira"'
      - " cb"
      - ' cb"'
      - " cylance"
      - ' cylance"'
      - " defender"
      - ' defender"'
      - " kaspersky"
      - ' kaspersky"'
      - " kes"
      - ' kes"'
      - " mc"
      - ' mc"'
      - " sec"
      - ' sec"'
      - " sentinel"
      - ' sentinel"'
      - " symantec"
      - ' symantec"'
      - " virus"
      - ' virus"'
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/info.yml
simulation:
  - type: atomic-red-team
    name: Security Software Discovery
    technique: T1518.001
    atomic_guid: f92a380f-ced9-491f-b338-95a991418ce2
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL