Execution of Forfiles via Explorer
Detects instances where the 'forfiles.exe' utility is executed by 'explorer.exe'. This is an atypical parent-child process relationship that may indicate an attempt to use 'forfiles' for indirect command execution or to facilitate malicious actions while avoiding direct command prompt usage.
Microsoft Sentinel (KQL)
