Browse Live Discover and Response Queries by Category
Approved

Search subfolders for a specific filename or extension.

Useful query to search entire subfolders for a specific extension or a filename. Supports wildcards in path and filename.

SELECT
  path,
  directory,
  filename,
  device,
  size
FROM file
WHERE directory LIKE 'C:\users\%\desktop%%' AND filename LIKE '%%.exe'

This solution was proposed by Karl Ackerman to my request how to perform such a discovery. Since then it seems that other users need this type of query too, so here it is. 

Genc Kelmendi

  • Hi everybody,

    Work fine with *.exe, not with *.zip, for example. Why?

    Query with .EXE:

    SELECT
      path,
      directory,
      filename,
      device,
      size
    FROM file
    WHERE directory LIKE 'D:\Install\Xtelsio\%' AND filename LIKE '%%.exe'

    Result:

    Query with .ZIP:

    SELECT
      path,
      directory,
      filename,
      device,
      size
    FROM file
    WHERE directory LIKE 'D:\Install\Xtelsio\%' AND filename LIKE '%%.zip'

    - no results -

    .ZIP files exists:

Unfiltered HTML