C:\\> net use \\\\<TARGET IP ADDRESS>
C:\\> net share
C:\\> net session
C:\\> wmic volume list brief
C:\\> wmic logicaldisk get description,filesystem,name,size
C:\\> wmic share get name,path
Find multiple file types or a file:
C:\\> dir /A /5 /T:A *,exe *,dll *,bat *·PS1 *,zip
C:\\> dir /A /5 /T:A <BAD FILE NAME>,exe
Find executable (.exe) files newer than Jan 1, 2017:
C:\\> forfiles /p C:\\ /M *,exe /5 /0 +1/1/2017 /C
"cmd /c echo @fdate @ftime @path"
Find multiple files types using loop:
C:\\> for %G in (.exe, .dll, .bat, .ps) do forfiles p "C:" -m *%G -s -d +1/1/2017 -c "cmd /c echo @fdate@ftime @path"
Search for files newer than date:
C:\\> forfiles /PC:\\ /5 /0 +1/01/2017 /C "cmd /c
echo @path @fdate"
Find large files: (example <20 MB)
C:\\> forfiles /5 /M * /C "cmd /c if @fsize GEQ
2097152 echo @path @fsize"
Find files with Alternate Data Streams:
Ref. https://technet.microsoft.com/enus/sysinternals/streams.aspx
C:\\> streams -s <FILE OR DIRECTORY>
Find files with bad signature into csv:
Ref. https://technet.microsoft.com/enus/sysinternals/bb897441.aspx
C:\\> sigcheck -c -h -s -u -nobanner <FILE OR DIRECTORY> > <OUTPUT FILENAME>,csv
Find and show only unsigned files with bad signature in C:
C:\\> sigcheck -e -u -vr -s C:\\
List loaded unsigned Dlls: