Remote File Download Via Findstr.EXE

Title: Remote File Download Via Findstr.EXE
Status: test
Description:Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Findstr/
  -https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
  -https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-10-05
modified:2024-03-05
Tags:

• -'attack.credential-access'
• -'attack.command-and-control'
• -'attack.stealth'
• -'attack.t1218'
• -'attack.t1564.004'
• -'attack.t1552.001'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_findstr:
CommandLine|contains:'findstr' Image|endswith:'findstr.exe' OriginalFileName:'FINDSTR.EXE'   selection_cli_download_1:
    CommandLine|contains|windash: ' -v '
  selection_cli_download_2:
    CommandLine|contains|windash: ' -l '
  selection_cli_download_3:
    CommandLine|contains: '\\\\'
  condition:selection_findstr and all of selection_cli_download_*
Falsepositives:
  -Unknown
Level: medium