detection.wiki

Detection rules › Sigma

Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE

Status
test
Severity
high
Log source
product windows, category process_creation
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1518.001 Software Discovery: Security Software Discovery

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE
id: 37db85d1-b089-490a-a59a-c7b6f984f480
status: test
description: Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service
author: frack113
date: 2021-12-16
modified: 2023-11-14
tags:
    - attack.discovery
    - attack.t1518.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\find.exe'
              - '\findstr.exe'
        - OriginalFileName:
              - 'FIND.EXE'
              - 'FINDSTR.EXE'
    selection_cli:
        CommandLine|contains: ' 385201' # Sysmon driver default altitude
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith:
          - '\find.exe'
          - '\findstr.exe'
    - OriginalFileName:
          - 'FIND.EXE'
          - 'FINDSTR.EXE'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains: ' 385201'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • 385201
Imageends_with
  • \find.exe corpus 8 (sigma 8)
  • \findstr.exe corpus 12 (sigma 12)
OriginalFileNameeq
  • FIND.EXE corpus 7 (sigma 7)
  • FINDSTR.EXE corpus 12 (sigma 12)