Permission Misconfiguration Reconnaissance Via Findstr.EXE

Title: Permission Misconfiguration Reconnaissance Via Findstr.EXE
Status: test
Description:Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
References:
  -https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
modified:2023-11-11
Tags:

• -'attack.credential-access'
• -'attack.t1552.006'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_findstr_img:
    - Image|endswith:
      - '\find.exe'
      - '\findstr.exe'
    - OriginalFileName:
      - 'FIND.EXE'
      - 'FINDSTR.EXE'
  selection_findstr_cli:
    CommandLine|contains:
      -'"Everyone"'
      -''Everyone''
      -'"BUILTIN\\"'
      -''BUILTIN\''

  selection_special:
    CommandLine|contains|all:
      -'icacls '
      -'findstr '
      -'Everyone'

  condition:all of selection_findstr_* or selection_special
Falsepositives:
  -Unknown
Level: medium