LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Forfiles.exe

View source

Selects and executes a command on a file or set of files. This command is useful for batch processing.

ExecuteADS
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1202

Executes specified command since there is a match for notepad.exe in the c:\windows\System32 folder.

COMMAND
forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"
USE CASE
Use forfiles to start a new process to evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE

ADS1

EXAMPLE 01T1564.004

Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\windows\system32 folder.

COMMAND
forfiles /p c:\windows\system32 /m notepad.exe /c "{PATH_ABSOLUTE}:evil.exe"
USE CASE
Use forfiles to start a new process from a binary hidden in an alternate data stream
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Windows\System32\forfiles.exe
C:\Windows\SysWOW64\forfiles.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Eric@vector_sec
Oddvar Moe@oddvarmoe