Windows Recon: Command Output Piped to findstr.exe

title: "Windows Recon: Command Output Piped to findstr.exe"
id: c6037f63-1761-4457-b3d9-2aa7986d23cd
related:
  - id: fe63010f-8823-4864-a96b-a7b4a0f7b929
    type: derived
  - id: ccb5742c-c248-4982-8c5c-5571b9275ad3
    type: derived
status: test
description: This rule flags Windows process creation where a command line includes reconnaissance-oriented commands combined with output filtering via findstr. It highlights attacker tradecraft for quickly extracting specific strings from recon output by piping command results into findstr. The detection relies on process creation telemetry with access to the full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1057/T1057.md#atomic-test-6---discover-specific-process---tasklist
  - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf
  - https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2023-07-06
modified: 2025-10-08
tags:
  - attack.discovery
  - attack.t1057
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ipconfig*|*find
      - net*|*find
      - netstat*|*find
      - ping*|*find
      - systeminfo*|*find
      - tasklist*|*find
      - whoami*|*find
  filter_optional_xampp:
    CommandLine|contains|all:
      - cmd.exe /c TASKLIST /V |
      - FIND /I
      - \xampp\
      - \catalina_start.bat
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output/info.yml
license: DRL-1.1