legitimate administrative tasks and scripts may use `dir` piped to `findstr` for routine file searches. filter based on known user behavior and approved administrative activity.

splunk

Techniques

Sample rules

Windows Dir Piped to Findstr Activity

source: splunk
technicques:

Description

The following analytic detects the execution of the dir command piped to findstr on Windows systems. This technique is commonly used by attackers during the reconnaissance phase to enumerate files, directories, or sensitive data by filtering directory listings for specific strings or patterns. While this command combination can have legitimate administrative uses, adversaries frequently leverage it to locate credentials, configuration files, or other high-value targets on a compromised system. If confirmed malicious, this activity could indicate an attacker is actively mapping the file system in preparation for data exfiltration, lateral movement, or further exploitation.

Detection logic


| tstats `security_content_summariesonly`
   count min(_time) as firstTime
         max(_time) as lastTime

from datamodel=Endpoint.Processes where

Processes.process="*dir *
|*findstr *"

by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
   Processes.parent_process_name Processes.parent_process_exec Processes.action
   Processes.dest Processes.process_current_directory Processes.process_path
   Processes.process_integrity_level Processes.original_file_name
   Processes.parent_process Processes.parent_process_path Processes.parent_process_guid
   Processes.parent_process_id Processes.process_guid
   Processes.process_id Processes.user Processes.process_name


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_dir_piped_to_findstr_activity_filter`