Recon Command Output Piped To Findstr.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND COMMANDLINE contains "ipconfig*|*find,net*|*find,netstat*|*find,ping*|*find,systeminfo*|*find,tasklist*|*find,whoami*|*find" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems), frack113
