Common directories that an attacker can abuse to drop files to disk, perform reconnaissance, and help facilitate attack surface mapping on a target host.
%SYSTEMROOT%\Temp or C:\Windows\Temp
Global directory containing temporary system files accessible to all users on the system.
All users, regardless of authority, are provided full read, write, and execute permissions in this directory.
Useful for dropping files as a low-privilege user on the system.
%TEMP% or C:\Users\<user>\AppData\Local\Temp
Local directory containing a user’s temporary files accessible only to the user account that it is attached to.
Provides full ownership to the user that owns this folder.
Useful when the attacker gains control of a local/domain joined user account.
%PUBLIC% or C:\Users\Public
Publicly accessible directory allowing any interactive logon account full access to read, write, modify, execute, etc., files and subfolders within the directory.
Alternative to the global Windows Temp Directory as it’s less likely to be monitored for suspicious activity.
%ProgramFiles% or C:\Program Files
Folder containing all 64-bit applications installed on the system. Useful for seeing what kind of applications are installed on the target system.
%ProgramFiles(x86)% or C:\Program Files (x86)
Folder containing all 32-bit applications installed on the system. Useful for seeing what kind of applications are installed on the target system.