Selects and executes a command on a file or set of files. This command is useful for batch processing. Located at: C:\Windows\System32\forfiles.exe; C:\Windows\SysWOW64\forfiles.exe.
forfilesforfilesSandbox: execFile · Timeout: 30s
security.execution.command system.file.alternate-data-stream Outputs
process.output Command execution output
filesystem_writeprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Executes specified command since there is a match for notepad.exe in the c:\windows\System32 folder. (Use forfiles to start a new process to evade defensive counter measures)
forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\windows\system32 folder. (Use forfiles to start a new process from a binary hidden in an alternate data stream)
forfiles /p c:\windows\system32 /m notepad.exe /c "{PATH_ABSOLUTE}:evil.exe"forfiles is a Windows LOLBin. Selects and executes a command on a file or set of files. This command is useful for batch processing. Located at: C:\Windows\System32\forfiles.exe; C:\Windows\SysWOW64\forfiles.exe.