Windows: findstr.exe LSASS keyword matching for process reconnaissance

title: "Windows: findstr.exe LSASS keyword matching for process reconnaissance"
id: 259c6a65-1d09-46ad-83b1-06a8456102fb
status: test
description: This rule flags Windows process creation events where findstr.exe (or find.exe) is invoked with command-line arguments containing the keyword "lsass". Such usage can indicate an attempt to enumerate or locate information related to the LSASS process, which attackers may target for credential-related objectives. The detection relies on process creation telemetry including Image (ending with \find.exe or \findstr.exe), OriginalFileName, and CommandLine content matching for specific "lsass" strings.
references:
  - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_lsass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2024-06-04
tags:
  - attack.credential-access
  - attack.t1552.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_findstr_img:
    - Image|endswith:
        - \find.exe
        - \findstr.exe
    - OriginalFileName:
        - FIND.EXE
        - FINDSTR.EXE
  selection_findstr_cli:
    CommandLine|contains: lsass
  selection_special:
    CommandLine|contains|windash:
      - ' /i "lsass'
      - " /i lsass.exe"
      - findstr "lsass
      - findstr lsass
      - findstr.exe "lsass
      - findstr.exe lsass
  condition: all of selection_findstr_* or selection_special
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_lsass/info.yml
license: DRL-1.1
related:
  - id: fe63010f-8823-4864-a96b-a7b4a0f7b929
    type: derived