Identifier / Programs / Windows
findstr.exe
Searches for patterns of text in files. Windows commands reference
LOLBAS ADS, Credentials, Download 13 Sigma rules name it 9 ATT&CK techniques 4 documented commands 12 known copies with hashes
How findstr.exe is abused
ADS T1564.004 Hide Artifacts: NTFS File Attributes
/vPrints only lines that don't contain a match. Windows commands reference/lProcesses search strings literally. Windows commands referenceCredentials T1552.001 Unsecured Credentials: Credentials In Files
/sSearches the current directory and all subdirectories. Windows commands reference/iIgnores the case of the characters when searching for the string. Windows commands referenceDownload T1105 Ingress Tool Transfer
/vPrints only lines that don't contain a match. Windows commands reference/lProcesses search strings literally. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for findstr.exe.
4 documented commands
ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges
Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file.
findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exeTrips no Sigma process-creation rule.
ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges
Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.
findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exeTrips 1 Sigma rule: mediumRemote File Download Via Findstr.EXE by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
Credentials T1552.001 Unsecured Credentials: Credentials In Files User privileges
Search for stored password in Group Policy files stored on SYSVOL.
findstr /S /I cpassword \\sysvol\policies\*.xmlTrips 4 Sigma rules: highFindstr GPP Passwords by frack113; mediumPotential Password Reconnaissance Via Findstr.EXE by Josh Nickels; mediumSuspicious SYSVOL Domain Group Policy Access by Markus Neis, Jonhnathan Ribeiro, oscd.community; lowInsensitive Subfolder Search Via Findstr.EXE by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
Download T1105 Ingress Tool Transfer User privileges
Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file.
findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}Trips 1 Sigma rule: mediumRemote File Download Via Findstr.EXE by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
3 of the 4 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for findstr.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for findstr.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real findstr.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\findstr.exe · signed by Microsoft Windows
4332173c1585b767864db04a042ba6f2a228e8cc7b040821344903eaff6817c310.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\findstr.exe · signed by Microsoft Windows
718dcdb4498fa61c7cc6b98bd369432751f73759e7f04e0d01b9569fb1bf535e10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\findstr.exe · signed by Microsoft Windows
1900c48fdb1c2ddfa59c37ba86affa502d44af55f313d0d53fac60d9b96943b610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\findstr.exe · signed by Microsoft Windows
b29be6da54121f5d9350c545ececce26f30a7f209ce0d9aaea8e00c27dda27a210.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\findstr.exe · signed by Microsoft Windows
3e543c71749de0e95d39eaf328fca253d5f025fd85ecb07670a1536ec87015da10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\findstr.exe · signed by Microsoft Windows
e09620769585acda7f33096f8cacc609d1bfa327d9da051a597ffffefd96172d10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\findstr.exe · signed by Microsoft Windows
6212e4eb194109c71815ace1ed8d56139dda04be2f6e1bb01eac9315c6fb5abf10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\findstr.exe · signed by Microsoft Windows
750ab5e1f3eb18cc42a4a4c7bab27753f6b26fb9752ad386183375309104428110.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\findstr.exe · signed by Microsoft Windows
2956f7bc863498dfcc868ce7df4c9c131a4a5c17b065658456afef7566ace1ee10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\findstr.exe · signed by Microsoft Windows
ea0c8f0ccb347acf136a9cf692a06f9fbd13604ce8ec2327d58cad7eefa0144f6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\findstr.exe · not signed
95d90aeccb3439ae2460468d249b3034f55074564ee48647b07c283037acea536.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\findstr.exe · not signed
d1d8a3b724bc9637e7602b5c6ed0df34378e6ff84e833182bc856e7ed531d388From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Find one or more strings in all files
findstr "string1 string2 ..." *IdentifyFind one or more strings in a piped command's output
dir | findstr "string1 string2 ..."IdentifyFind one or more strings in all files recursively
findstr /s "string1 string2 ..." *Identify/sSearches the current directory and all subdirectories. Windows commands referenceNone of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.
Options
Show every option of findstr.exe
/bMatches the text pattern if it is at the beginning of a line./eMatches the text pattern if it is at the end of a line./lProcesses search strings literally./rProcesses search strings as regular expressions./sSearches the current directory and all subdirectories./iIgnores the case of the characters when searching for the string./xPrints lines that match exactly./vPrints only lines that don't contain a match./nPrints the line number of each line that matches./mPrints only the file name if a file contains a match./oPrints character offset before each matching line./pSkips files with non-printable characters./offDoes not skip files that have the offline attribute set./fGets a file list from the specified file./cUses the specified text as a literal search string./gGets search strings from the specified file./dSearches the specified list of directories./aSpecifies color attributes with two hexadecimal digits./?Displays Help at the command prompt.