Doing Windows #DFIR on Linux. What Windows directory is this command-line useful in: find * -type f | while read file; do echo ===== $file; strings -e l "$file" | grep -E '(Command|Arguments)'; echo; done

Dec 15, 2020 · 2:15 PM UTC

2
2
7
Replying to @hal_pomeranz
Hmmm, after hours of scrolling filenames, got some of this: "= OneDrive/Documents/Virtual Machines/LTS20/LTS20-s004.vmdk Software\Microsoft\Command Processor goDoCommand('cmd_copyImage'); Software\Microsoft\Command Processor \Shell\Open\Command ...", FireFox JS from Ubuntu VM ?
1
I applaud your effort. Try it in C:\Windows\System32\Tasks
1
more replies
Replying to @hal_pomeranz
Bwuh ... Trying this in WSL2 Kali now, certainly prints many lines from ~