Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the usage of "findstr" with the argument "385201", which is the default driver altitude for Sysinternals Sysmon. This activity could indicate an adversary attempting to discover if Sysmon is installed on a system, even if the service name has been changed.