{"id":"4fe074b4-b833-4081-8f24-7dcfeca72b42","title":"Security Tools Keyword Lookup Via Findstr.EXE","description":"Detects execution of \"findstr\" to search for common names of security tools. Attackers often pipe the results of recon commands such as \"tasklist\" or \"whoami\" to \"findstr\" in order to filter out the results.\nThis detection focuses on the keywords that the attacker might use as a filter.\n","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2023-10-20","modified":"2023-11-14","tags":["attack.discovery","attack.t1518.001"],"technique_ids":["T1518.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery","https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/","https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf"],"source_path":"rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml","source_sha256":"30e29aa6bbab1d6335f15757e5a13620ca3d70ce2b3e3c8cf42ce28f3b3c6d59","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Security Tools Keyword Lookup Via Findstr.EXE\nid: 4fe074b4-b833-4081-8f24-7dcfeca72b42\nrelated:\n    - id: fe63010f-8823-4864-a96b-a7b4a0f7b929\n      type: derived\nstatus: test\ndescription: |\n    Detects execution of \"findstr\" to search for common names of security tools. Attackers often pipe the results of recon commands such as \"tasklist\" or \"whoami\" to \"findstr\" in order to filter out the results.\n    This detection focuses on the keywords that the attacker might use as a filter.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery\n    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/\n    - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf\nauthor: Nasreddine Bencherchali (Nextron Systems), frack113\ndate: 2023-10-20\nmodified: 2023-11-14\ntags:\n    - attack.discovery\n    - attack.t1518.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\find.exe'\n              - '\\findstr.exe'\n        - OriginalFileName:\n              - 'FIND.EXE'\n              - 'FINDSTR.EXE'\n    selection_cli:\n        CommandLine|endswith:\n            # Note: Add additional keywords to increase and enhance coverage\n            # Note:\n            #   We use the double quote variation because in cases of where the command is executed through cmd for example:\n            #       cmd /c \"tasklist | findstr virus\"\n            #   Logging utilties such as Sysmon would capture the end quote as part of findstr execution\n            - ' avira'\n            - ' avira\"'\n            - ' cb'\n            - ' cb\"'\n            - ' cylance'\n            - ' cylance\"'\n            - ' defender'\n            - ' defender\"'\n            - ' kaspersky'\n            - ' kaspersky\"'\n            - ' kes'\n            - ' kes\"'\n            - ' mc'\n            - ' mc\"'\n            - ' sec'\n            - ' sec\"'\n            - ' sentinel'\n            - ' sentinel\"'\n            - ' symantec'\n            - ' symantec\"'\n            - ' virus'\n            - ' virus\"'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Security Software Discovery\n      technique: T1518.001\n      atomic_guid: f92a380f-ced9-491f-b338-95a991418ce2\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1518.001","id":"T1518.001","name":"Security Software Discovery","page":"techniques/enterprise/T1518.001/"}],"data_path":"data/detection-rules/4fe074b4-b833-4081-8f24-7dcfeca72b42.json","kind":"sigma"}