Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1518.001` Software Discovery: Security Software Discovery

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE
id: 37db85d1-b089-490a-a59a-c7b6f984f480
status: test
description: Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service
author: frack113
date: 2021-12-16
modified: 2023-11-14
tags:
    - attack.discovery
    - attack.t1518.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\find.exe'
              - '\findstr.exe'
        - OriginalFileName:
              - 'FIND.EXE'
              - 'FINDSTR.EXE'
    selection_cli:
        CommandLine|contains: ' 385201' # Sysmon driver default altitude
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith:
          - '\find.exe'
          - '\findstr.exe'
    - OriginalFileName:
          - 'FIND.EXE'
          - 'FINDSTR.EXE'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: ' 385201'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`385201`	`field:"CommandLine" kind:match value:" 385201"`
`Image`	ends_with	`\find.exe` corpus 7 (sigma 7) `\findstr.exe` corpus 11 (sigma 11)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`FIND.EXE` corpus 7 (sigma 7) `FINDSTR.EXE` corpus 12 (sigma 12)	`field:"OriginalFileName" kind:eq`