Windows Sysmon Discovery Attempt via Findstr.exe Default Driver Altitude (385201)
Alerts on findstr/find.exe executions containing 385201, consistent with using Sysmon default driver altitude for discovery.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-16
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where findstr.exe (or find.exe variants) are executed with the specific argument fragment "385201", consistent with the Sysmon driver default driver altitude technique. Attackers may use this to enumerate or prepare discovery of an installed Sysmon-related service/driver, even when binaries are renamed. The detection relies on Windows process creation telemetry, including the executed image path/name and the command line content.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Sysmon Discovery Attempt via Findstr.exe Default Driver Altitude (385201)
id: f734103e-ea38-4868-a816-a9f6edba3245
status: test
description: This rule identifies process creation events where findstr.exe (or find.exe variants) are executed with the specific argument fragment "385201", consistent with the Sysmon driver default driver altitude technique. Attackers may use this to enumerate or prepare discovery of an installed Sysmon-related service/driver, even when binaries are renamed. The detection relies on Windows process creation telemetry, including the executed image path/name and the command line content.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml
author: frack113, Huntrule Team
date: 2021-12-16
modified: 2023-11-14
tags:
- attack.discovery
- attack.t1518.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \find.exe
- \findstr.exe
- OriginalFileName:
- FIND.EXE
- FINDSTR.EXE
selection_cli:
CommandLine|contains: " 385201"
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 37db85d1-b089-490a-a59a-c7b6f984f480
type: derived