where
Displays the location of files that match the given search pattern. Windows commands reference
On Windows 1 Sigma rule name it File where.exe
Windows
Displays the location of files that match the given search pattern. - If you do not specify a file name extension, the extensions listed in the PATHEXT environment variable are appended to the pattern by default. - Where can run recursive searches, display file information such as date or size, and accept environment variables in place of paths on local computers.
where [/r <Dir>] [/q] [/f] [/t] [$<ENV>:|<Path>:]<Pattern>[ ...]To find all files named Test in drive C of the current computer and its subdirectories, type
where /r c:\ testIdentify/rIndicates a recursive search, starting with the specified directory. Windows commands referenceTo list all files in the Public directory, type
where $public:*.*IdentifyTo find all files named Notepad in drive C of the remote computer, Computer1, and its subdirectories, type
where /r \\computer1\c notepad.*Identify/rIndicates a recursive search, starting with the specified directory. Windows commands reference/r <Dir>Indicates a recursive search, starting with the specified directory./qReturns an exit code (0 for success, 1 for failure) without displaying the list of matched files./fDisplays the results of the where command in quotation marks./tDisplays the file size and the last modified date and time of each matched file.[$<ENV>:|<Path>:]<Pattern>[ ...]Specifies the search pattern for the files to match. At least one pattern is required, and the pattern can include wildcard characters (* and ?). By default, where searches the current directory and the paths that are specified in the PATH environment variable. You can specify a different path to search by using the format $ENV:Pattern (where ENV is an existing environment variable containing one or more paths) or by using the format Path:Pattern (where Path is the directory path you want to search). These optional formats should not be used with the /r command-line option./?Displays help at the command prompt.Several platforms
Report all known instances of a command. It could be an executable in the $PATH environment variable, an alias, or a shell builtin.
Find all instances of a command
where commandIdentifyWindows
Display the location of files that match the search pattern. Defaults to current work directory and paths in the %PATH% environment variable. In PowerShell, this command is an alias of Where-Object. This documentation is based on the Command Prompt (cmd) version of where.
Display the location of file pattern
where file_patternIdentifyDisplay the location of file pattern including file size and date
where /T file_patternIdentify/TDisplays the file size and the last modified date and time of each matched file. Windows commands referenceRecursively search for file pattern at specified path
where /R path\to\directory file_patternIdentify/RIndicates a recursive search, starting with the specified directory. Windows commands referenceSilently return the error code for the location of the file pattern
where /Q file_patternIdentify/QReturns an exit code (0 for success, 1 for failure) without displaying the list of matched files. Windows commands reference