.. /Forfiles.exe
Star

Execute (EXE)
Alternate data streams (EXE)

Selects and executes a command on a file or set of files. This command is useful for batch processing.

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Executes specified command since there is a match for notepad.exe in the c:\windows\System32 folder.

    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /c c:\windows\system32\calc.exe"
    Use case
    Use forfiles to start a new process to evade defensive counter measures
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1202: Indirect Command Execution
    Tags
    Execute: EXE

Alternate data streams

  1. Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\windows\system32 folder.

    forfiles /p c:\windows\system32 /m notepad.exe /c "C:\Windows\Temp\file.ext:evil.exe"
    Use case
    Use forfiles to start a new process from a binary hidden in an alternate data stream
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1564.004: NTFS File Attributes
    Tags
    Execute: EXE