atomic-red-team/Windows/Discovery/File_and_Directory_Discovery.md

File and Directory Discovery

MITRE ATT&CK Technique: T1083

Directory listing

Input:

dir /s c:\ >> %temp%\download
dir /s "c:\Documents and Settings" >> %temp%\download
dir /s "c:\Program Files\" >> %temp%\download
dir /s d:\ >> %temp%\download
dir "%systemdrive%\Users\*.*"
dir "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.*"
dir "%userprofile%\Desktop\*.*"