find.exe

Find String (grep) Utility file version info

Program on Windows 14 known copies with hashes 9 Sigma rules name it

Is it the real find.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.3\resources\app\git\usr\bin\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionFind String (grep) Utility

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\find.exe · signed by Microsoft Windows

a4af9ef6e345b3b4ea50dde672a986c14f9a195e407ebac36b1652aacc10e3ee

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\find.exe · signed by Microsoft Windows

a70a969194935f4fba39b99f88e5891ebf94d293156715cadb6633d2d230c806

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\find.exe · signed by Microsoft Windows

1a1876c5eed2b8cd9e14ebff3f4eeb7e21552a4c6aab4bf392a55f8df3612dab

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\find.exe · signed by Microsoft Windows

63ddbcb0233ed7c8c90748869ec5879309a351ffc6d230af66ccde8372f00b34

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\find.exe · signed by Microsoft Windows

68ebdc30bcab4a4773100267db191454dee42773d203c3516a56f4b61d96e9bd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\find.exe · signed by Microsoft Windows

e8a0628110df5468a8bb894e4efeea82e08e2149e4c8caa1f38a98cc2ad9d857

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\find.exe · signed by Microsoft Windows

6a42c41b345f3f8a22e5f3658b4673abae612242acf12042ec5de4dee57a98d8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\find.exe · signed by Microsoft Windows

a3d85036bcb0b3b50691e02d1952821e7b943680d8f8e4cc16613d2c72f44e6c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\find.exe · signed by Microsoft Windows

1257a4ad54442b26d343abc2cedf73e9938ff5638b9f01581b4884e020c6f56a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\find.exe · signed by Microsoft Windows

40c0ec6d7371d316bc1f0abe80d0236f613c9fb88dce2d9b5d5fd4a1a59e8b49

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\find.exe · not signed

dfa180160e8d58fb471ac0c4602619852ffd74d6426464e0eb6c61c06afe065b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\find.exe · not signed

ffbd63d8e677610ec22481d2bcd46ad231ef9db2cd9d599de97a51d4ec184771

Version not recorded · C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.4\resources\app\git\usr\bin\find.exe · signed by GitHub

1085b68aed79d8f7355380988f0129e8e2f6baf6fe9724be132e0cf3d1ace52e

Version not recorded · C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.3\resources\app\git\usr\bin\find.exe · signed by GitHub

ff67cda3dcf392ef7ed5d0fb51b4bd3923c8f4e64b5cc81563ebe3345f54a975

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name find.exe

highFindstr GPP Passwordsfrack113

highLSASS Process Reconnaissance Via Findstr.EXEFlorian Roth (Nextron Systems)

highSysmon Discovery Via Default Driver Altitude Using Findstr.EXEfrack113

highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson

mediumFindstr Launching .lnk FileTrent Liffick

mediumPermission Misconfiguration Reconnaissance Via Findstr.EXENasreddine Bencherchali (Nextron Systems)

mediumPotentially Suspicious JWT Token Search Via CLINasreddine Bencherchali (Nextron Systems), kagebunsher

mediumSecurity Tools Keyword Lookup Via Findstr.EXENasreddine Bencherchali (Nextron Systems), frack113, MalGamy (Nextron Systems)

Sigma names find.exe in 9 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.