Filesystem searched for credential strings in files

Siemphony@siemphonymediumT1552.001unverified

AN0856's usable arm is the search itself: a text-search tool pointed at files with a credential keyword as the pattern, which is how insecurely stored passwords are found before they are used. The rule gates on the tool and on the keyword, both read off the one command line, and deliberately does not gate on a file extension — MITRE's FileNamePattern knob is where an estate narrows this to its own `.config`, `.env` or `.xml` conventions, and a fixed extension list would drop the single-file case entirely. The brief's other two Windows sources are not used because neither can carry the behaviour: Sysmon EventID 11 fires on file creation, not on the read that discovery consists of, and Security 4624/4648 record the later logon, which only becomes evidence when joined to the file access across MITRE's TimeWindow knob — a correlation Sigma cannot express. Prerequisite: this is written in the Sysmon EventID 1 vocabulary; where an estate feeds Security 4688 into `process_creation` instead, `CommandLine` is populated only if *Audit Process Creation* and the separate *Include command line in process creation events* policy are both on, and without them every event arrives with an empty command line and this rule is silently blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0307, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "findstr" or ProcessCommandLine contains "Select-String") and (ProcessCommandLine contains "password" or ProcessCommandLine contains "passwd" or ProcessCommandLine contains "pwd=" or ProcessCommandLine contains "credential" or ProcessCommandLine contains "secret" or ProcessCommandLine contains "apikey" or ProcessCommandLine contains "api_key" or ProcessCommandLine contains "accesskey" or ProcessCommandLine contains "connectionstring"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*findstr*" OR CommandLine="*Select-String*") AND (CommandLine="*password*" OR CommandLine="*passwd*" OR CommandLine="*pwd=*" OR CommandLine="*credential*" OR CommandLine="*secret*" OR CommandLine="*apikey*" OR CommandLine="*api_key*" OR CommandLine="*accesskey*" OR CommandLine="*connectionstring*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*findstr*" OR TO_LOWER(process.command_line) LIKE "*select-string*") AND (TO_LOWER(process.command_line) LIKE "*password*" OR TO_LOWER(process.command_line) LIKE "*passwd*" OR TO_LOWER(process.command_line) LIKE "*pwd=*" OR TO_LOWER(process.command_line) LIKE "*credential*" OR TO_LOWER(process.command_line) LIKE "*secret*" OR TO_LOWER(process.command_line) LIKE "*apikey*" OR TO_LOWER(process.command_line) LIKE "*api_key*" OR TO_LOWER(process.command_line) LIKE "*accesskey*" OR TO_LOWER(process.command_line) LIKE "*connectionstring*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(findstr|Select-String)</field>    <field name="CommandLine" type="pcre2">(?i)(password|passwd|pwd=|credential|secret|apikey|api_key|accesskey|connectionstring)</field>    <description>Filesystem searched for credential strings in files</description>    <mitre>      <id>T1552.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: credential_dump
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 9dd5b1dc-e41b-4554-b212-2f344f5f0932

ATT&CKT1552.001

T1552.001Credentials In Files

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoncredential dump

credential dumpAI draft — unreviewed

01 · What this rule detects

AN0856 asks for access to insecurely stored credential files correlated with the later use of what was found. Sigma cannot express that correlation, so the rule written here takes only the first half, and only its loudest form: a text-search tool invoked with a credential word as its pattern. It is the hunt, not the theft — findstr /si password *.config across a share, or Select-String -Pattern apikey over a checkout.

02 · Telemetry you need

Windows process_creation, written in the Sysmon EventID 1 vocabulary. The whole rule reads one field, CommandLine, so everything depends on that field being populated. Where an estate feeds Security 4688 into this category instead, CommandLine exists only if Audit Process Creation and the separate Include command line in process creation events policy are both enabled — neither is on in a default install or the CIS baseline. Without them every event arrives with an empty command line and the rule is blind, not quiet. There is a second, subtler dependency: the Select-String arm only fires when the cmdlet appears on powershell.exe's own command line. Typed at an interactive console, or called from inside a .ps1 the command line names only by path, the string never reaches the process creation event. That half of the coverage needs Script Block Logging (PowerShell/Operational 4104), a different logsource and a different rule.

03 · How the logic works

Two gates on the same line, ANDed. The tool alone is unremarkable and the keyword alone matches any command that mentions a password; together they approximate "someone searched files for a credential". The rule deliberately does not gate on a file extension: MITRE's FileNamePattern knob is where an estate narrows this to its own .env, .config or .xml conventions, and a fixed extension list here would drop the single-file case. The keyword list is the pipeline's own, not MITRE's — MITRE names the knob, nothing more. The other two sources in AN0856 went unused: Sysmon EID 11 fires on creation, not on the read that discovery is, and Security 4624/4648 record only the later logon.

04 · Common false positives

Build and deployment automation is the dominant match by a wide margin — a pipeline that greps or rewrites a connection string in web.config or appsettings.json matches on every run. Secret-scanning and DLP tooling matches its own signature, because the search it performs is the search this rule looks for. Helpdesk troubleshooting and developers grepping a repository do the same thing on purpose. selection_tool is a bare substring, so a script named findstr-wrapper.ps1 or a path containing the word satisfies the tool gate with no search taking place.

05 · Detection maturity

tier_1: until it has. The stated level of medium is not supported by its own first false positive; on any build agent this is a continuous match, which is what low describes.
tier_2: begins with the identity filters and the alias coverage above.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Filter the pipeline identities and scanner hosts first; they produce most of the volume. Split the tool gate — Image|endswith: '\findstr.exe' is the exact test for the binary, leaving the CommandLine form for the cmdlet. Note what a two-character alias does to this rule: sls -Pattern password matches neither token, and neither does Get-Content x | ? { $_ -match 'password' }. Add cpassword (Group Policy Preferences, named in the ATT&CK text) and unattend to the keyword list — both are near-zero-noise and both are missing today.

Declared by the author

Build and deployment automation that uses findstr or Select-String to check or rewrite a connection string, password placeholder or API key in web.config, appsettings.json or a transform file. On a build agent this runs on every pipeline execution and is the highest-volume match by a long way, which is why the level here is not raised further.
Helpdesk and administrator troubleshooting of an authentication failure, where an operator greps an application config or log for the word password to confirm which account or connection string a service is using.
Secret-scanning, DLP and compliance tooling that hunts for plaintext credentials across shares and workstations as a hardening check — it matches its own signature, because the search it performs is the search this rule looks for.
Developers running Select-String -Pattern password over a repository checkout or a log directory while debugging, which is routine on engineering workstations.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1552.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/9dd5b1dc-e41b-4554-b212-2f344f5f0932

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Filesystem searched for credential strings in files

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it