BIOC Informational

Cleartext password harvesting using find tools

On Windows, the find and findstr tools can be used to find content in files on disk. This rule is looking for cases where the find command is looking for the string 'password', which indicates an attempt to find passwords.

Module:
Platform Analytics
Agent event type:
Process execution
Category:
Credential Access
Status:
Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
Indicator:

Process action type = execution AND target process name = find.exe , findstr.exe AND target process cmd = *password*

Preventable: yes