Insensitive Subfolder Search Via Findstr.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•0•14

Detects the execution of `findstr.exe` with both the `/s` (search subfolders) and `/i` (case-insensitive search) flags. Adversaries commonly use `findstr.exe` as a living-off-the-land binary (LOLBIN) to search for sensitive information, configuration files, or other interesting data within a compromised system, often filtering through command output or file contents.