Techniques
Sample rules
Windows Indirect Command Execution Via forfiles
- source: splunk
- technicques:
- T1202
Description
The following analytic detects programs that have been started by forfiles.exe. According to Microsoft, the ‘The forfiles command lets you run a command on or pass arguments to multiple files’. While this tool can be used to start legitimate programs, usually within the context of a batch script, it has been observed being used to evade protections on command line execution.
Detection logic
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_indirect_command_execution_via_forfiles_filter`