Suspicious CMD Findstr Command with For Loop and Token Parsing

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious command patterns using findstr with for loops and token/delimiter parsing that may indicate data extraction and processing techniques. Adversaries may use findstr combined with for loops to search, extract, and parse specific content from files or command output, often as part of reconnaissance or data exfiltration activities.

2025-12-17 00:00:00

None

283e2d9e-6ce4-4fc2-b739-6e7bfbe4e459

attack.execution attack.t1059.003 attack.defense-evasion attack.t1027.010

Nextron Sigma feed only (private)