Security Tools Keyword Lookup Via Findstr.EXE

Title: Security Tools Keyword Lookup Via Findstr.EXE
Status: test
Description:Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery
  -https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
  -https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2023-10-20
modified:2023-11-14
Tags:

• -'attack.discovery'
• -'attack.t1518.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\find.exe'
      - '\findstr.exe'
    - OriginalFileName:
      - 'FIND.EXE'
      - 'FINDSTR.EXE'
  selection_cli:
    CommandLine|endswith:
      -' avira'
      -' avira"'
      -' cb'
      -' cb"'
      -' cylance'
      -' cylance"'
      -' defender'
      -' defender"'
      -' kaspersky'
      -' kaspersky"'
      -' kes'
      -' kes"'
      -' mc'
      -' mc"'
      -' sec'
      -' sec"'
      -' sentinel'
      -' sentinel"'
      -' symantec'
      -' symantec"'
      -' virus'
      -' virus"'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium