Windows Process Creation: Automated Document and Directory Discovery via dir and findstr

title: "Windows Process Creation: Automated Document and Directory Discovery via dir and findstr"
id: 9e861ca3-da23-4da6-8d28-7948e32dbb4d
status: test
description: This rule identifies Windows process creation events where the command line targets common document file types (.doc/.docx/.xls/.xlsx/.ppt/.pptx/.rtf/.pdf/.txt) and includes recursive, bare directory listing parameters. It also flags commands running FINDSTR.EXE with specific switches used to enumerate or extract matching strings from files. This matters because these scripted collection behaviors help attackers rapidly identify and harvest internal content without interactive user activity, relying on Windows process creation telemetry and command-line contents.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_automated_collection.yml
author: frack113, Huntrule Team
date: 2021-07-28
modified: 2022-11-11
tags:
  - attack.collection
  - attack.t1119
  - attack.credential-access
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_ext:
    CommandLine|contains:
      - .doc
      - .docx
      - .xls
      - .xlsx
      - .ppt
      - .pptx
      - .rtf
      - .pdf
      - .txt
  selection_other_dir:
    CommandLine|contains|all:
      - "dir "
      - " /b "
      - " /s "
  selection_other_findstr:
    OriginalFileName: FINDSTR.EXE
    CommandLine|contains:
      - " /e "
      - " /si "
  condition: selection_ext and 1 of selection_other_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f576a613-2392-4067-9d1a-9345fb58d8d1
    type: derived