Remote File Download Via Findstr.EXE

detection:
  selection_cli_download_1:
    CommandLine|contains|windash: ' -v '
  selection_cli_download_2:
    CommandLine|contains|windash: ' -l '
  selection_cli_download_3:
    CommandLine|contains: '\\\\'
  selection_findstr:
    - CommandLine|contains: 'findstr'
    - Image|endswith: 'findstr.exe'
    - OriginalFileName: 'FINDSTR.EXE'
  condition: selection_findstr and all of selection_cli_download_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

The commands LOLBAS or GTFOBins documents for findstr.exe trip it: each is on its program’s page, read by CmdID.