This hunting analytic detects Windows command-line activity where dir is used with a pipe to findstr to filter directory listings. The dir/findstr pattern is a common discovery technique used during the reconnaissance phase to enumerate files, directories, or sensitive data, enabling attackers to locate credentials, configuration files, or other high-value targets on the host. While legitimate administrative usage exists, patterns that involve dir with findstr—especially when observed in non-admin contexts or with unusual process lineage, working directories, or in conjunction with other suspicious indicators—warrant investigation. The rule is implemented against endpoint telemetry (EDR) and aligns with the Endpoint data model by analyzing process creation events and complete command lines, including fields such as process name, process path, parent process, user, and process hash. Contextual enrichment (vendor product, host, and user) improves discrimination between legitimate admin activity and adversary reconnaissance. The technique maps to MITRE ATT&CK T1119 (Automated Discovery) and is relevant to Windows discovery techniques and discovery workflows.