Windows Process Creation: Automated Document and Directory Discovery via dir and findstr

Flags Windows commands combining recursive dir listing, FINDSTR usage, and document-type targeting in one execution.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2021-07-28
Updated: 2026-07-30

ATT&CK techniques

Cred Access → Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
- T1119Automated Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creation events where the command line targets common document file types (.doc/.docx/.xls/.xlsx/.ppt/.pptx/.rtf/.pdf/.txt) and includes recursive, bare directory listing parameters. It also flags commands running FINDSTR.EXE with specific switches used to enumerate or extract matching strings from files. This matters because these scripted collection behaviors help attackers rapidly identify and harvest internal content without interactive user activity, relying on Windows process creation telemetry and command-line contents.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious Recursive Credential and Wallet Search Written to Temp Inventory File

Linux File Events: Malicious GitHub Workflow File Creation (shai-hulud-workflow*.yml/yaml)

Suspicious DNS Exfiltration to azurestaticprovider Backdoor Domain

Suspicious Azure Key Vault Access Policy Modification

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious Access to Cloud and Database Credential Files via Process

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Suspicious LameHug Staging Directory and Info File Creation on Windows

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Windows Process Creation: Automated Document and Directory Discovery via dir and findstr

Pivot detection · T1552.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-automated-document-and-directory-discovery-via-dir-and--f576a613

title: "Windows Process Creation: Automated Document and Directory Discovery via dir and findstr"
id: 9e861ca3-da23-4da6-8d28-7948e32dbb4d
status: test
description: This rule identifies Windows process creation events where the command line targets common document file types (.doc/.docx/.xls/.xlsx/.ppt/.pptx/.rtf/.pdf/.txt) and includes recursive, bare directory listing parameters. It also flags commands running FINDSTR.EXE with specific switches used to enumerate or extract matching strings from files. This matters because these scripted collection behaviors help attackers rapidly identify and harvest internal content without interactive user activity, relying on Windows process creation telemetry and command-line contents.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_automated_collection.yml
author: frack113, Huntrule Team
date: 2021-07-28
modified: 2022-11-11
tags:
  - attack.collection
  - attack.t1119
  - attack.credential-access
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_ext:
    CommandLine|contains:
      - .doc
      - .docx
      - .xls
      - .xlsx
      - .ppt
      - .pptx
      - .rtf
      - .pdf
      - .txt
  selection_other_dir:
    CommandLine|contains|all:
      - "dir "
      - " /b "
      - " /s "
  selection_other_findstr:
    OriginalFileName: FINDSTR.EXE
    CommandLine|contains:
      - " /e "
      - " /si "
  condition: selection_ext and 1 of selection_other_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f576a613-2392-4067-9d1a-9345fb58d8d1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL