Forfiles Command Execution with /c Flag

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•21

Detects the execution of the 'forfiles.exe' utility with the '/c' flag. This behavior, while legitimate, can be abused by adversaries to proxy execution of arbitrary commands or binaries, potentially bypassing application whitelisting controls. This technique is often associated with Living Off The Land Binaries (LOLBAS).