Reconnaissance Command Output Piped To Findstr.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•1•0•16

Detects the execution of common reconnaissance commands (ipconfig, net, netstat, ping, systeminfo, tasklist, whoami) where the output is piped to `findstr.exe`. This technique is often used by attackers during the reconnaissance phase to extract specific information.