Remote File Download Via Findstr.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution `T1564.004` Hide Artifacts: NTFS File Attributes
Credential Access	`T1552.001` Unsecured Credentials: Credentials In Files
Command & Control	`T1105` Ingress Tool Transfer

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Remote File Download Via Findstr.EXE
id: 587254ee-a24b-4335-b3cd-065c0f1f4baa
related:
    - id: bf6c39fc-e203-45b9-9538-05397c1b4f3f
      type: obsolete
status: test
description: |
    Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Findstr/
    - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
    - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
date: 2020-10-05
modified: 2024-03-05
tags:
    - attack.credential-access
    - attack.command-and-control
    - attack.stealth
    - attack.t1218
    - attack.t1564.004
    - attack.t1552.001
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_findstr:
        - CommandLine|contains: findstr
        - Image|endswith: 'findstr.exe'
        - OriginalFileName: 'FINDSTR.EXE'
    selection_cli_download_1:
        CommandLine|contains|windash: ' -v '
    selection_cli_download_2:
        CommandLine|contains|windash: ' -l '
    selection_cli_download_3:
        CommandLine|contains: '\\\\'
    condition: selection_findstr and all of selection_cli_download_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection_findstr and all of selection_cli_download_*

Stage 1: `selection_findstr`

selection_findstr:
    - CommandLine|contains: findstr
    - Image|endswith: 'findstr.exe'
    - OriginalFileName: 'FINDSTR.EXE'

Stage 2: `selection_cli_download_1`

selection_cli_download_1:
    CommandLine|contains|windash: ' -v '

Stage 3: `selection_cli_download_2`

selection_cli_download_2:
    CommandLine|contains|windash: ' -l '

Stage 4: `selection_cli_download_3`

selection_cli_download_3:
    CommandLine|contains: '\\\\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-l` transforms: `windash` corpus 3 (sigma 3) `-v` transforms: `windash` `\\\\` corpus 6 (sigma 5, splunk 1) `findstr` corpus 8 (sigma 6, splunk 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`findstr.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"findstr.exe"`
`OriginalFileName`	eq	`FINDSTR.EXE` corpus 12 (sigma 12)	`field:"OriginalFileName" kind:eq value:"FINDSTR.EXE"`

Remote File Download Via Findstr.EXE

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_findstr

Stage 2: selection_cli_download_1