Windows findstr.exe Subfolder and Case-Insensitive Search Flags
Alerts on findstr.exe executions that include both -s (subfolders) and -i (case-insensitive) flags.
- Product
- windows
- Category
- process_creation
- Author
- Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-10-05
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies executions of findstr.exe where the command line includes both the subfolder search flag (-s) and the case-insensitive search flag (-i). Attackers and administrators can use findstr to quickly enumerate or filter files, including when searching through directory trees for specific content. Telemetry required includes Windows process creation details such as Image/OriginalFileName and the full CommandLine.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Findstr/
- oddvar.moehttps://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
- gist.github.comhttps://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows findstr.exe Subfolder and Case-Insensitive Search Flags
id: 43c36773-2b00-4be6-8ac3-cd139ff89368
related:
- id: bf6c39fc-e203-45b9-9538-05397c1b4f3f
type: obsolete
- id: 04936b66-3915-43ad-a8e5-809eadfd1141
type: derived
status: test
description: This rule identifies executions of findstr.exe where the command line includes both the subfolder search flag (-s) and the case-insensitive search flag (-i). Attackers and administrators can use findstr to quickly enumerate or filter files, including when searching through directory trees for specific content. Telemetry required includes Windows process creation details such as Image/OriginalFileName and the full CommandLine.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Findstr/
- https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
- https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml
author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-05
modified: 2024-03-05
tags:
- attack.credential-access
- attack.command-and-control
- attack.stealth
- attack.t1218
- attack.t1564.004
- attack.t1552.001
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_findstr:
- CommandLine|contains: findstr
- Image|endswith: findstr.exe
- OriginalFileName: FINDSTR.EXE
selection_cli_search_subfolder:
CommandLine|contains|windash: " -s "
selection_cli_search_insensitive:
CommandLine|contains|windash: " -i "
condition: selection_findstr and all of selection_cli_search_*
falsepositives:
- Administrative or software activity
level: low
license: DRL-1.1