BIOC
Informational
✕
Cleartext password harvesting using find tools
On Windows, the find and findstr tools can be used to find content in files on disk. This rule is looking for cases where the find command is looking for the string 'password', which indicates an attempt to find passwords.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
Indicator:
Process action type = execution AND target process name = find.exe , findstr.exe AND target process cmd = *password*
Preventable: yes