Windows Process Creation: Automated Document and Directory Discovery via dir and findstr
Flags Windows commands combining recursive dir listing, FINDSTR usage, and document-type targeting in one execution.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-07-28
- Updated
- 2026-07-30
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation events where the command line targets common document file types (.doc/.docx/.xls/.xlsx/.ppt/.pptx/.rtf/.pdf/.txt) and includes recursive, bare directory listing parameters. It also flags commands running FINDSTR.EXE with specific switches used to enumerate or extract matching strings from files. This matters because these scripted collection behaviors help attackers rapidly identify and harvest internal content without interactive user activity, relying on Windows process creation telemetry and command-line contents.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_automated_collection.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Automated Document and Directory Discovery via dir and findstr"
id: 9e861ca3-da23-4da6-8d28-7948e32dbb4d
status: test
description: This rule identifies Windows process creation events where the command line targets common document file types (.doc/.docx/.xls/.xlsx/.ppt/.pptx/.rtf/.pdf/.txt) and includes recursive, bare directory listing parameters. It also flags commands running FINDSTR.EXE with specific switches used to enumerate or extract matching strings from files. This matters because these scripted collection behaviors help attackers rapidly identify and harvest internal content without interactive user activity, relying on Windows process creation telemetry and command-line contents.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_automated_collection.yml
author: frack113, Huntrule Team
date: 2021-07-28
modified: 2022-11-11
tags:
- attack.collection
- attack.t1119
- attack.credential-access
- attack.t1552.001
logsource:
category: process_creation
product: windows
detection:
selection_ext:
CommandLine|contains:
- .doc
- .docx
- .xls
- .xlsx
- .ppt
- .pptx
- .rtf
- .pdf
- .txt
selection_other_dir:
CommandLine|contains|all:
- "dir "
- " /b "
- " /s "
selection_other_findstr:
OriginalFileName: FINDSTR.EXE
CommandLine|contains:
- " /e "
- " /si "
condition: selection_ext and 1 of selection_other_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: f576a613-2392-4067-9d1a-9345fb58d8d1
type: derived