Automated Document and Credential File Collection via Command Prompt
This rule detects the execution of command-line tools like 'dir' or 'findstr' in conjunction with specific file extensions (e.g., .doc, .pdf, .txt) that are commonly associated with sensitive data or credentials. This behavior indicates an attempt at automated collection of data, potentially for exfiltration or further analysis by an adversary. The rule specifically looks for 'dir' commands with '/b' (bare format) and '/s' (subdirectories) flags, or 'findstr' with '/e' (end of line) and '/si' (case-insensitive search for string in files) flags, targeting common document and text file types.
Sigma
