Forfiles is a Windows command-line utility that selects files based on age or pattern and then runs a command against each match. Attackers abuse it to execute payloads, clean up traces or stage follow-on actions from living-off-the-land commands. Defenders should review unexpected Forfiles use, especially when it launches scripts or binaries.
How Forfiles selects and executes commands
Forfiles is a Windows command-line utility that filters files by criteria such as age, then runs a command against each matching file. In practice, that means it can act like a loop over a target set of files, passing each match into whatever command the operator supplies. The utility is legitimate, but its power makes it useful for automation and abuse alike.
The key behaviour is that selection and action are separate. First, Forfiles identifies files that meet the requested conditions, then it invokes the chosen command once per match. That makes it flexible for bulk maintenance, but also dangerous when the command is a script launcher, a downloader, or a binary that blends into normal Windows activity.
Because the command is user-controlled, the security question is not whether Forfiles is malicious by itself, but what it was told to do. A defender reading a process tree should treat the utility as a container for follow-on behaviour, not as the end state. If the parent process, command line, or target path looks unusual, the real concern is usually the embedded action rather than the selector.
Why attackers like it for living-off-the-land activity
Forfiles fits living-off-the-land tradecraft because it is built into Windows and can be used to launch other programs without dropping a custom loader. That makes it attractive for payload execution, cleanup, and staged execution after initial access. It is especially suspicious when it appears alongside other native utilities or when it is used to touch paths that do not match ordinary administrative workflows. Living off the Land Guide
From a defender’s perspective, the abuse pattern is straightforward: an operator uses a trusted binary to reduce noise, then chains it into something more obviously adversarial. That may include launching a script, copying or deleting files, or preparing a later stage of execution. The utility itself does not provide stealth, but it can help the command blend into a busy endpoint or server environment.
Forfiles also matters because its behaviour can look routine in isolated telemetry. A single invocation may not stand out, so context becomes critical: what spawned it, what command followed it, which directories were targeted, and whether the timing matches maintenance windows. Without that context, a legitimate housekeeping job and an intrusion step can look nearly identical.
What defenders should verify in telemetry and response
Forfiles use deserves review when it originates from an unexpected parent process, targets unusual locations, or launches scripts and binaries that are not part of known administration tooling. Analysts should treat the command line as primary evidence, because that is where the real action is hidden. A suspicious invocation often becomes clearer when paired with nearby process creation, file write, or script execution events.
The most useful triage questions are practical. Was the command issued by an admin workflow or by an application that should not be performing file iteration? Did it run from an interactive shell, a service, or a remote execution context? Did it enumerate a directory that contains staging artefacts, recently dropped payloads, or cleanup targets? Those details are often more valuable than the binary name alone.
If the execution looks unplanned, check for follow-on actions rather than stopping at the initial launch. Forfiles is often a stepping stone, so you want to know whether it preceded payload execution, persistence changes, or trace removal. MITRE ATT&CK Enterprise Matrix is useful here because it helps map the utility to broader technique patterns such as command execution, defense evasion, and post-compromise activity.
Risk and Threat Considerations
Forfiles is risky because it turns a built-in file selector into a command runner, which makes it easy to conceal secondary actions behind a normal Windows utility. The same flexibility that helps administrators can help an attacker stage execution, cleanup, or chained tooling with less obvious signalling.
Failure mechanism: An operator supplies a command that is executed repeatedly for each matched file, allowing a trusted utility to proxy malicious or high-impact activity while reducing the visibility of the true payload.
Impact: Defenders may miss the real objective if they only classify the parent binary, and attackers can use the utility to amplify persistence, delete evidence, or trigger follow-on commands across many files.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Forfiles often launches scripts or commands to execute follow-on activity. |
| T1036 — Masquerading | Living-off-the-land abuse relies on trusted utilities blending into normal admin activity. | |
| Recommendation — Map Forfiles command lines to T1059 patterns and hunt for suspicious script execution. Check whether native binaries are being used to hide malicious execution paths. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Unexpected Forfiles usage is detected through command-line and process telemetry. |
| CIS-10 — Malware Defenses | Forfiles abuse is a common execution path for payload staging and follow-on malware activity. | |
| Recommendation — Collect and review process creation and command-line logs for unusual native tool use. Correlate native utility execution with payload staging and block known malicious chains. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Forfiles investigations depend on command-line and process creation records. |
| Recommendation — Generate detailed process-creation and command-line audit records for native utility use. | ||
Practitioner Guidance
What to verify: Confirm whether each Forfiles invocation belongs to a known maintenance job, patching workflow, or software deployment task. If the command line points to script interpreters, download utilities, or unusual writable locations, treat it as a stronger incident lead than the utility name alone.
Decision rule: If the command launched by Forfiles can modify system state, fetch content, or execute additional code, prioritise containment and command-line review before deciding it is benign. If it only enumerates files for a clearly documented admin task, validate the change window and ownership, then close it out with evidence.
Practitioner takeaway: Forfiles is best understood as an execution wrapper, so the security decision depends on the command it carries and the context around it, not on the binary itself.