Windows LSASS Process Reconnaissance Using findstr.exe or find.exe

title: Windows LSASS Process Reconnaissance Using findstr.exe or find.exe
id: 259c6a65-1d09-46ad-83b1-06a8456102fb
status: test
description: This rule flags Windows process creation where find.exe or findstr.exe is invoked with command-line arguments containing the keyword "lsass" (including case-insensitive search patterns). Searching for LSASS-related strings is consistent with recon activity targeting the LSASS process or its identifiers. It relies on process creation telemetry, specifically the executable name and the command-line contents.
references:
  - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_lsass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2024-06-04
tags:
  - attack.credential-access
  - attack.t1552.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_findstr_img:
    - Image|endswith:
        - \find.exe
        - \findstr.exe
    - OriginalFileName:
        - FIND.EXE
        - FINDSTR.EXE
  selection_findstr_cli:
    CommandLine|contains: lsass
  selection_special:
    CommandLine|contains|windash:
      - ' /i "lsass'
      - " /i lsass.exe"
      - findstr "lsass
      - findstr lsass
      - findstr.exe "lsass
      - findstr.exe lsass
  condition: all of selection_findstr_* or selection_special
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_lsass/info.yml
license: DRL-1.1
related:
  - id: fe63010f-8823-4864-a96b-a7b4a0f7b929
    type: derived