huntrule

Windows: Recon command output piped to findstr.exe

Alerts on Windows command lines running recon commands whose output is filtered with findstr.exe.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published
2023-07-06
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

Identifies Windows process creation where command-line arguments indicate recon-like commands whose output is piped to findstr.exe via inline command execution. This matters because attackers frequently filter or extract specific reconnaissance results using native tools to reduce noise and focus on targeted information. The detection relies on process creation telemetry capturing the full command line, looking for recon command patterns combined with “|*find”.

Reporting behind it

Related detections9 linkedT1057 — drag to rearrange
Suspicious Container Environment Discovery via Proc Cgroup
Suspicious Doenerium Host Fingerprinting via cmd.exe
Malicious Turla Kopiluwak Reconnaissance Output to Windows Temp via process_creation
Suspicious Bazar Network Reconnaissance Command Batch
Suspicious Privilege Discovery Spawned by M365 Copilot Process
Suspicious Security Product Enumeration via tasklist
Suspicious node.exe Spawning tasklist Process Enumeration
Suspicious Virtual Machine Detection via WMI Win32_Process Query (via process_creation)
Antivirus Software Discovery via tasklist and findstr
Windows: Recon command output piped to findstr.exe
Pivot detection · T1057 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.