Paths and environment variables

Variables are expanded per user, so %APPDATA% means a different folder for every person. Always expand them in the right user's context.

C:\Users\m.osei> echo %APPDATA%
C:\Users\m.osei\AppData\Roaming
C:\Users\m.osei> echo %TEMP%
C:\Users\m.osei\AppData\Local\Temp

defender tip In PowerShell the same values are $env:APPDATA and $env:TEMP.

You will often get exports rather than a live machine. The lab has m.osei's set output in ws-014/env.txt.

analyst@ir-box:~$ grep -i appdata= ws-014/env.txt
APPDATA=C:\Users\m.osei\AppData\Roaming
LOCALAPPDATA=C:\Users\m.osei\AppData\Local
analyst@ir-box:~$ grep -i '^path=' ws-014/env.txt
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Users\m.osei\AppData\Local\Microsoft\WindowsApps

you should see Path lists the folders Windows searches when you type a bare program name. A user-writable folder early in Path would be a finding. Here it is last, which is normal.

Every running program has an image path. Real system processes come from System32. Anything from a user profile deserves a reason.

analyst@ir-box:~$ wc -l ws-014/running-paths.txt
20 ws-014/running-paths.txt
analyst@ir-box:~$ grep -c System32 ws-014/running-paths.txt
12
analyst@ir-box:~$ grep Users ws-014/running-paths.txt

you should see Run the last command yourself in the lab. Count the lines and decide which ones you can explain.

defender tip On a live machine: Get-Process | Select-Object Name, Path | Where-Object Path -like 'C:\Users\*'.

Windows runs the first match it finds along PATH. A folder users can write to, early in PATH, lets a planted program win over a real one with the same name.

analyst@ir-box:~$ grep -i '^path=' ws-014/env.txt | grep -o 'C:.Users[^;]*'

you should see One user folder is in PATH, the WindowsApps folder that Windows adds for every user. It sits after the system folders, which is the normal order.