Windows Process Creation: findstr.exe used with argument 385201 (Sysmon default driver altitude)

title: "Windows Process Creation: findstr.exe used with argument 385201 (Sysmon default driver altitude)"
id: f734103e-ea38-4868-a816-a9f6edba3245
status: test
description: This rule flags process execution of findstr.exe (or find.exe) where the command line contains the value 385201, which is used as the default driver altitude. Attackers may leverage this parameter to enumerate or attempt installation/discovery of Sysmon-related services by matching expected driver altitude behavior, even if service naming is altered. The detection relies on Windows process creation telemetry, specifically the process image path/name and command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml
author: frack113, Huntrule Team
date: 2021-12-16
modified: 2023-11-14
tags:
  - attack.discovery
  - attack.t1518.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \find.exe
        - \findstr.exe
    - OriginalFileName:
        - FIND.EXE
        - FINDSTR.EXE
  selection_cli:
    CommandLine|contains: " 385201"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 37db85d1-b089-490a-a59a-c7b6f984f480
    type: derived