Forfiles
MITRE ATT&CK: S0193 View on attack.mitre.org
- Profile updated
- 2026-07-07 15:32:53
Context
Forfiles is a Windows utility commonly used in batch jobs to execute commands on one or more selected files or directories (ex: list all directories in a drive, read the first line of all files created yesterday, etc.). Forfiles can be executed from either the command line, Run window, or batch files/scripts.
Detection coverage
- 73 Sigma rules
Malware & tools used
- Indirect Command Execution (attack-pattern)
- Data from Local System (attack-pattern)
- File and Directory Discovery (attack-pattern)
Used by threat actors
- APT28 (threat-actor)
Reports & references
- MITRE ATT&CK — S0193 (report)
- Microsoft — Cc753551(V=Ws.11) (report)