Identifier / Programs / Windows
forfiles.exe
Selects and runs a command on a file or set of files. Windows commands reference
LOLBAS Execute, ADS 10 Sigma rules name it 3 ATT&CK techniques 2 documented commands 12 known copies with hashes
How forfiles.exe is abused
Execute T1202 Indirect Command Execution
/PSpecifies the path from which to start the search. Windows commands reference/MSearches files according to the specified search mask. Windows commands reference/CRuns the specified command on each file. Windows commands referenceADS T1564.004 Hide Artifacts: NTFS File Attributes
/PSpecifies the path from which to start the search. Windows commands reference/MSearches files according to the specified search mask. Windows commands reference/CRuns the specified command on each file. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for forfiles.exe.
2 documented commands
Execute T1202 Indirect Command Execution User privileges
Executes specified command since there is a match for notepad.exe in the c:\windows\System32 folder.
forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"Trips 1 Sigma rule: mediumForfiles Command Execution by Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges
Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\windows\system32 folder.
forfiles /p c:\windows\system32 /m notepad.exe /c "{PATH_ABSOLUTE}:evil.exe"Trips 1 Sigma rule: mediumForfiles Command Execution by Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for forfiles.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for forfiles.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real forfiles.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\forfiles.exe · signed by Microsoft Windows
12d8883320640e9bddcfc4e37fcc25a592b3e818ab717fdfd0418c6c0aaabe2010.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\forfiles.exe · signed by Microsoft Windows
a9553f89031333d6b88c53c4d82b2f8c261d11abeaaafc7e9cbaf43c12e887f910.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\forfiles.exe · signed by Microsoft Windows
7074d2a9c3d669a15d5b3a7ba1226dbba05888cc537cf055fed6371f32f0c1f510.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\forfiles.exe · signed by Microsoft Windows
9b4886f187489a190bb2c412772c1998539f086c63a4cfd72ff3b107cbc2190710.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\forfiles.exe · signed by Microsoft Windows
0027ce0037fdee37f189aa74facf0eb7683524a0306c124621db79b366ce9ff910.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\forfiles.exe · signed by Microsoft Windows
ace18b3bdac31fb4d731377f3950d78db28b09896aa71224658b9d49de2e47d210.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\forfiles.exe · signed by Microsoft Windows
fa84d5b043ead140fe304cbc71a9bfb3d24d3542fab45db65606c47808bd927210.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\forfiles.exe · signed by Microsoft Windows
ff892cc591bed1b9ba539aeabd86e9d19387d4378f050676553f21e340df68ef10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\forfiles.exe · signed by Microsoft Windows
092db96382406a82080d353da255a38107868425c91267a47e17053a1fd6713910.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\forfiles.exe · signed by Microsoft Windows
5b2ba93b56d9da593cbd896fd153414bf6c2c301f5fb034974d1504fa087b9556.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\forfiles.exe · not signed
6481bc37aba95442a91e76268559529bb94147cb127a5715afaadca6d01917266.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\forfiles.exe · not signed
b23d7c93c9b1d568e608ebae4ed38634f73280aa61104687d60aa3db33f93307From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Search for files in the current directory
forfilesIdentifySearch for files in a specific directory
forfiles /p path\to\directoryIdentify/pSpecifies the path from which to start the search. Windows commands referenceRun the specified command for each file
forfiles /c "command"Identify/cRuns the specified command on each file. Windows commands referenceTrips 1 Sigma rule: mediumForfiles Command Execution by Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Of the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.
Options
Show every option of forfiles.exe
/PSpecifies the path from which to start the search./MSearches files according to the specified search mask./SInstructs the forfiles command to search in subdirectories recursively./CRuns the specified command on each file./DSelects files with a last modified date within the specified time frame: Selects files with a last modified date later than or equal to (+) or earlier than or equal to (-) the specified date, where *date* is in the same…/?Displays the help text in the cmd window.