SauronEye

SauronEye

SauronEye is a search tool built to aid red teams in finding files containing specific keywords.

Features:

• Search multiple (network) drives
• Search contents of files
• Search contents of Microsoft Office files (.doc, .docx, .xls, .xlsx)
• Find VBA macros in old 2003 .xls and .doc files
• Search multiple drives multi-threaded for increased performance
• Supports regular expressions in search keywords
• Compatible with Cobalt Strike's execute-assembly

It's also quite fast, can do 50k files, totaling 1,3 TB on a network drive in under a minute (with realistic file filters). Searches a C:\ (on a cheap SATA SSD) in about 15 seconds.

Usage examples

…

Search multiple directories, including network drives:

SauronEye.exe --directories C:\ \\SOMENETWORKDRIVE\C$ --filetypes .txt .bat .docx .conf --contents --keywords password pass*

Search paths and shares containing spaces:

SauronEye.exe -d "C:\Users\\user\Path with a space" -d "\\SOME NETWORK DRIVE\C$" --filetypes .txt --keywords password pass*

…

Notes

SauronEye does not search %WINDIR% and %APPDATA%. Use the --systemdirs flag to search the contents of Program Files*. SauronEye relies on functionality only available from .NET 4.7.2, and so requires >= .NET 4.7.2 to run.