findstr

findstr is Windows’ built-in regular-expression-capable text filter — the rough counterpart to *NIX grep. grep is the POSIX original with a richer regex dialect and better performance; findstr is what’s already on every Windows box.

Practical patterns

:: Filter command output — the classic systeminfo fingerprint:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
 
:: Search files recursively, case-insensitive, with line numbers:
findstr /S /I /N "password" *.txt *.xml *.config
 
:: Multiple literal strings with /C: (spaces inside one string):
findstr /C:"user name" /C:"full name" users.txt
 
:: Match at line start/end with /B and /E; invert with /V:
findstr /B "ERROR" app.log
findstr /V /C:"DEBUG" app.log

Key flags: /I case-insensitive, /S recurse subdirectories, /N line numbers, /M filenames only, /R regex (default; /L forces literal), /C:"..." literal string containing spaces, /G:file read search terms from a file, /X whole-line match.

Operational notes

• Hunting credentials on disk without tools: findstr /S /I /C:"password" /C:"passwd" /C:"pwd" C:\*.xml C:\*.ini C:\*.config 2>nul — pairs naturally with unattended-installation-credentials and iis-configuration-credentials hunting.
• findstr /S /I "secret" \\host\share\* works over SMB paths for share-mining.
• Regex dialect is limited (no + quantifier, no alternation groups; [...], *, \</word\> boundaries exist). For heavy lifting use PowerShell Select-String, which is the modern replacement and accepts .NET regex.
• Piping into findstr is how operators trim noisy built-ins (systeminfo, driverquery, sc query) down to decision-relevant lines — see windows-reconnaissance-commands.

Related

• windows-reconnaissance-commands — findstr as the filter for recon output
• systeminfo — the classic systeminfo | findstr host fingerprint
• unattended-installation-credentials — where string searches for passwords pay off
• ipconfig — ipconfig /displaydns | findstr ... for targeted cache mining

Sources

• Microsoft Learn — findstr
• Microsoft Learn — Select-String (PowerShell)
• SS64 — FINDSTR.exe