Remote File Download Via Findstr.EXE (587254ee-a24b-4335-b3cd-065c0f1f4baa)

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Remote File Download Via Findstr.EXE (587254ee-a24b-4335-b3cd-065c0f1f4baa)	Sigma-Rules	Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	1
Remote File Download Via Findstr.EXE (587254ee-a24b-4335-b3cd-065c0f1f4baa)	Sigma-Rules	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	1
Remote File Download Via Findstr.EXE (587254ee-a24b-4335-b3cd-065c0f1f4baa)	Sigma-Rules	NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	1
Remote File Download Via Findstr.EXE (587254ee-a24b-4335-b3cd-065c0f1f4baa)	Sigma-Rules	Credentials In Files - T1552.001 (837f9164-50af-4ac0-8219-379d8a74cefc)	Attack Pattern	1
NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8)	Attack Pattern	2
Unsecured Credentials - T1552 (435dfb86-2697-4867-85b5-2fef496c0517)	Attack Pattern	Credentials In Files - T1552.001 (837f9164-50af-4ac0-8219-379d8a74cefc)	Attack Pattern	2