Remote File Download Via Findstr.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•25

Detects the execution of "findstr" with specific command-line flags and a remote share path. This combination of flags allows "findstr" to download the content of a file located on a remote share, as described in the LOLBAS project. This technique can be used for ingress tool transfer or data staging.