Windows forfiles.exe Child Process Masquerading via cmd.exe Execution

title: Windows forfiles.exe Child Process Masquerading via cmd.exe Execution
id: 674ce959-e329-4d8d-8c9c-9cedef5eff34
status: test
description: This rule flags process creation where forfiles.exe is launched from a non-default location and spawns cmd.exe. Attackers can use forfiles’ hardcoded behaviors to disguise execution and run commands originating from the current working context, improving stealth. The detection relies on Windows process creation telemetry, matching the parent command line pattern, child image name ending in cmd.exe, and filtering out cases where the parent and images originate from default system directories.
references:
  - https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_forfiles_child_process_masquerading.yml
author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati, Huntrule Team
date: 2024-01-05
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentCommandLine|endswith:
      - .exe
      - .exe"
    Image|endswith: \cmd.exe
    CommandLine|startswith: /c echo "
  filter_main_parent_not_sys:
    ParentImage|contains:
      - :\Windows\System32\
      - :\Windows\SysWOW64\
    ParentImage|endswith: \forfiles.exe
    Image|contains:
      - :\Windows\System32\
      - :\Windows\SysWOW64\
    Image|endswith: \cmd.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f53714ec-5077-420e-ad20-907ff9bb2958
    type: derived