Skip to content

Path expansion mappings

Joachim Metz edited this page Oct 24, 2016 · 6 revisions

Commonly used path expansion mappings used by Artifacts (largely inherited from GRR).

Path expansion Environment variable Description
environ_path %PATH% or $PATH
environ_temp %TEMP% or $TEMP
environ_systemroot %SystemRoot% Windows system root typically "C:\Windows"
environ_windir %WinDir% Windows directory typically "C:\Windows"
environ_programfiles %ProgramFiles% Windows program files directory, typically "C:\Program Files"
environ_programfilesx86 %ProgramFilesX86% Windows program files directory, typically "C:\Program Files (X86)"
environ_systemdrive %SystemDrive% Windows system drive, typically "C:"
environ_allusersprofile
environ_allusersappdata

Also see:

Clone this wiki locally