Windows Sysmon Discovery Attempt via Findstr.exe Default Driver Altitude (385201)

Alerts on findstr/find.exe executions containing 385201, consistent with using Sysmon default driver altitude for discovery.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-12-16
Updated
2026-07-31

ATT&CK techniques

Discovery
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Lateral Movement

  10. Collection

  11. C2

  12. Exfiltration

  13. Impact

What it detects

This rule identifies process creation events where findstr.exe (or find.exe variants) are executed with the specific argument fragment "385201", consistent with the Sysmon driver default driver altitude technique. Attackers may use this to enumerate or prepare discovery of an installed Sysmon-related service/driver, even when binaries are renamed. The detection relies on Windows process creation telemetry, including the executed image path/name and the command line content.

Related detections9 linkedT1518.001 — drag to rearrange
Antivirus Software Discovery via tasklist and findstr
Suspicious Security Software Discovery via WMI or Defender Query (via process_creation)
Suspicious Security Software Discovery via PowerShell SecurityCenter2 AntivirusProduct Query (via process_creation)
Suspicious Antivirus Product Enumeration via WMI Query via process_creation
Suspicious Security Software Discovery via tasklist and findstr (via process_creation)
Suspicious Security Process Enumeration via Tasklist And Findstr
Suspicious Security Software Enumeration on macOS
macOS csrutil Used to Disable System Integrity Protection (SIP)
macOS SIP Status Enumeration via csrutil status
Windows Sysmon Discovery Attempt via Findstr.exe Default Driver Altitude (385201)
Pivot detection · T1518.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.