huntrule

Suspicious PowerShell Execution via Forfiles LOLBIN

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-20
Updated
2026-10-20
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the forfiles utility used to spawn PowerShell, an indirect execution technique that breaks parent-child telemetry. Malicious LNK campaigns use forfiles to proxy execution of PowerShell payloads. Interactive use of forfiles to launch PowerShell is uncommon and suspicious.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious SharePoint w3wp Spawning Command Shell and PowerShell
Suspicious Encoded PowerShell Command Execution
Suspicious Lampion ClickFix PowerShell Download and Execute via Run Dialog
Suspicious Hidden Encoded PowerShell Execution
Malicious PowerShell Download Cradle Spawned by Quick Assist
Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog
Suspicious Data Exfiltration to webhook.site via PowerShell Invoke-WebRequest (via ps_script)
Suspicious PowerShell Download and Execute via iwr Piped to iex
Suspicious ScreenConnect Remote Access Client Spawning PowerShell (via process_creation)
Suspicious PowerShell Execution via Forfiles LOLBIN
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.