dir

dir is the Windows/DOS directory-listing command — the rough equivalent of ls on *NIX. It exists in cmd.exe on every Windows version and as an alias for Get-ChildItem inside PowerShell, so it works in either shell, which makes it one of the first commands available on a fresh foothold.

Useful flags

Flag	Effect
/S	Recurse into subdirectories
/P	Pause after each screenful
/A	Filter by attributes (e.g. /A:H for hidden files)
/O:N	Sort by name (/O:D by date, /O:S by size)
/B	Bare format — names only, useful for scripting
/Q	Show file owner

Wildcards are supported, and combined with /S this becomes a quick recursive file search:

dir /S /P example.txt
dir /S /B *.txt

Operational notes

• dir output includes volume info and byte counts by default — pipe through findstr or use /B when scripting.
• For attribute-based hunting (hidden/system files), dir /A:H /S and dir /A:S /S surface files that Explorer hides by default.
• PowerShell’s Get-ChildItem (aliased to dir, ls, gci) is the scriptable successor — it returns objects rather than text, so prefer it when chaining into filters (Where-Object, Select-String).
• Listing directories on a compromised host is T1083 (File and Directory Discovery) in MITRE ATT&CK terms; see windows-reconnaissance-commands for the broader post-exploitation discovery toolkit.

Sources

• Microsoft Learn — dir
• MITRE ATT&CK T1083 — File and Directory Discovery

Related: windows-reconnaissance-commands, windows-ntfs-permissions