Storm-0408 Malvertising AV Discovery via findstr

Daniel Jeremiah@daniyyell

•updated Jun 2, 2026•0•0•4

This rule detects the execution of 'findstr.exe' with command-line arguments that include common strings associated with antivirus software processes or services. This activity is often performed by malware, specifically observed in Storm-0408 malvertising campaigns, to discover installed security products before attempting evasion. The rule filters out instances where 'msiexec.exe' is the parent process, as this can indicate legitimate software inventory scripts.