Write to ADS, discover, or download files with Findstr.exe
findstr /S /I cpassword \\sysvol\policies\*.xml
Search for stored password in Group Policy files stored on SYSVOL.
Find credentials stored in cpassword attrbute
C:\Windows\System32\findstr.exe, C:\Windows\SysWOW64\findstr.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml
Oddvar Moe (@oddvarmoe)