Windows findstr Launches .lnk via Command Line

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process executions where find.exe or findstr.exe are started and their command line ends with a .lnk reference. An attacker can use living-off-the-land utilities to enumerate and trigger shortcut files, which can lead to follow-on execution. The detection relies on process creation telemetry, specifically the executable image name and the command line ending in a .lnk path or quoted .lnk value.

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange

Windows renamed dctask64.exe execution via known IMPHASH values

Suspicious Rclone Exfiltration Masquerading as wininit.exe

Suspicious Executable Running from Public Pictures Directory

Suspicious Python Execution via Renamed Synaptics Binary

Agent Tesla Persistence via Realtek Named Scheduled Task Batch

Suspicious Interlock Fake Updater Executable Execution

Malicious User Account Created by a Computer Account (via security)

Suspicious Execution of agent.exe From WinSyncDefender AppData Directory (via process_creation)

Malicious Scheduled Task Masquerading as Auto Update via schtasks (via process_creation)

Windows findstr Launches .lnk via Command Line

Pivot detection · T1036 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-findstr-used-with-lnk-suffix-to-trigger-shortcut-execut-33339be3

title: Windows findstr Launches .lnk via Command Line
id: 46586365-68ab-4c3a-9081-983bee1b1c27
status: test
description: This rule flags Windows process executions where find.exe or findstr.exe are started and their command line ends with a .lnk reference. An attacker can use living-off-the-land utilities to enumerate and trigger shortcut files, which can lead to follow-on execution. The detection relies on process creation telemetry, specifically the executable image name and the command line ending in a .lnk path or quoted .lnk value.
references:
  - https://www.bleepingcomputer.com/news/security/hhsgov-open-redirect-used-by-coronavirus-phishing-to-spread-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_lnk.yml
author: Trent Liffick, Huntrule Team
date: 2020-05-01
modified: 2024-01-15
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1202
  - attack.t1027.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \find.exe
        - \findstr.exe
    - OriginalFileName:
        - FIND.EXE
        - FINDSTR.EXE
  selection_cli:
    CommandLine|endswith:
      - .lnk
      - .lnk"
      - .lnk'
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 33339be3-148b-4e16-af56-ad16ec6c7e7b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL