Query: Sigma rule for Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on
Matching passage: Sigma rule: Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on. Logsource: windows / process_creation. Rule: title: Recon Command Output Piped To Findstr.EXE id: ccb5742c-c248-4982-8c5c-5571b9275ad3 related: - id: fe63010f-8823-4864-a96b-a7b4a0f7b929 type: derived status: test description: 'Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1057/T1057.md#atomic-test-6---discover-specific-process---tasklist - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf - https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2023-07-06 modified: 2025-10-08 tags: - attack.discovery - attack.t1057 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ipconfig*|*find - net*|*find - netstat*|*find - ping*|*find - systeminfo*|*find - tasklist*|*find - whoami*|*find filter_optional_xampp: CommandLine|contains|all: - cmd.exe /c TASKLIST /V | - FIND /I - \xampp\ - \catalina_start.bat condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output/info.yml
Near-miss passage: Sigma rule: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the w. Logsource: windows / registry_set. Rule: title: Suspicious Execution Of Renamed Sysinternals Tools - Registry id: f50f3c09-557d-492d-81db-9064a8d4e211 related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 8023f872-3f1d-4301-a384-801889917ab4 type: similar status: test description: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \ProcDump - \Process Explorer - \PsExec - \PsLoggedon - \PsLoglist - \PsPasswd - \PsPing - \PsService - \SDelete TargetObject|endswith: \EulaAccepted filter: Image|endswith: - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - \handle.exe - \handle64.exe - \handle64a.exe - \livekd.exe - \livekd64.exe - \procdump.exe - \procdump64.exe - \procdump64a.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \PsExec.exe - \PsExec64.exe - \PsExec64a.exe - \PsLoggedon.exe - \PsLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe - \pspasswd.exe - \pspasswd64.exe - \pspasswd64a.exe - \PsPing.exe - \PsPing64.exe - \PsPing64a.exe - \PsService.exe - \PsService64.exe - \PsService64a.exe - \sdelete.exe condition: selection and not filter falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/info.yml