Windows findstr.exe used for subfolder ( -s ) and case-insensitive ( -i ) searches

Alerts on findstr.exe executions that include both -s (subfolders) and -i (case-insensitive) flags.

FreeUnreviewedSigmalowv1

windows-findstr-exe-used-for-subfolder-s-and-case-insensitive-i-searches-04936b66

title: Windows findstr.exe used for subfolder ( -s ) and case-insensitive ( -i ) searches
id: 43c36773-2b00-4be6-8ac3-cd139ff89368
related:
  - id: bf6c39fc-e203-45b9-9538-05397c1b4f3f
    type: obsolete
  - id: 04936b66-3915-43ad-a8e5-809eadfd1141
    type: derived
status: test
description: This rule flags Windows process creation where findstr.exe is executed with both the subfolder search flag (-s) and the case-insensitive flag (-i). Attackers may use findstr’s built-in searching to locate files or to refine and filter command output while operating stealthily. It relies on process creation telemetry including the executable name and the full command line with specific flag strings.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Findstr/
  - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml
author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-05
modified: 2024-03-05
tags:
  - attack.credential-access
  - attack.command-and-control
  - attack.stealth
  - attack.t1218
  - attack.t1564.004
  - attack.t1552.001
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_findstr:
    - CommandLine|contains: findstr
    - Image|endswith: findstr.exe
    - OriginalFileName: FINDSTR.EXE
  selection_cli_search_subfolder:
    CommandLine|contains|windash: " -s "
  selection_cli_search_insensitive:
    CommandLine|contains|windash: " -i "
  condition: selection_findstr and all of selection_cli_search_*
falsepositives:
  - Administrative or software activity
level: low
license: DRL-1.1

What it detects

This rule flags Windows process creation where findstr.exe is executed with both the subfolder search flag (-s) and the case-insensitive flag (-i). Attackers may use findstr’s built-in searching to locate files or to refine and filter command output while operating stealthily. It relies on process creation telemetry including the executable name and the full command line with specific flag strings.

Known false positives

Administrative or software activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.