Forfiles.EXE Child Process Masquerading

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•0•16

Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. This technique can be used for defense evasion by masquerading the execution of arbitrary commands.