How do attackers use Forfiles?

How Forfiles Becomes an Execution Primitive

Forfiles is attractive to attackers because it can enumerate files by name, wildcard, and age, then hand each match to a command interpreter. That turns a legitimate cleanup utility into a simple way to target specific artifacts, launch scripts, or drive follow-on actions without writing a custom loader.

The abuse pattern usually looks mundane in telemetry: a command line with file filters, a loop over matching files, and then a second process that does the real work. That makes Forfiles useful for staged execution, but also for masking intent inside otherwise ordinary maintenance-style activity.

Because it is a built-in Windows utility, Forfiles can blend into admin workflows and scripted housekeeping. Defenders should treat it as a dual-use launcher when it appears in unusual parent-child chains, especially when invoked from a script host, Office-spawned process, or remote management session.

What Attackers Do With It After Discovery

Once they have a file set, attackers commonly use Forfiles to run payloads against every matching file, copy or rename tools into place, or delete traces after a task completes. In practice, the same mechanism can support execution, staging, and cleanup depending on the command that follows the match.

That flexibility matters because the attacker does not need a separate dropper for every step. A single Forfiles invocation can locate a target directory, pass each result to cmd.exe or another interpreter, and then trigger a script, encoded command, or destructive action against the discovered files.

In incident response, the most useful interpretation is not just "Forfiles was present," but "what file selection logic did it use, and what executable did it hand control to next?" The pattern often reveals whether the operator was targeting payload staging, evidence removal, or both.

For a broader view of how attackers chain legitimate utilities into malware delivery and post-exploitation activity, the Living off the Land Guide is the right reference point for this class of abuse.

Detection Signals That Separate Admin Use From Abuse

Forfiles is most suspicious when it appears in a non-administrative context, with obfuscated arguments, encoded commands, or unusual file paths. High-confidence alerts usually come from the process chain around it, not from the binary alone: script engines, Office child processes, and remote sessions are all common launch points in malicious tradecraft.

Look for patterns where Forfiles immediately launches another interpreter, touches executable extensions, or operates on directories that do not fit routine cleanup. Age-based targeting is especially useful to attackers because it can exclude fresh decoys and focus on files that already existed before the intrusion or that are likely to be worth deleting later.

Telemetry that includes full command lines, parent process context, and file-system changes will usually tell you whether the activity is administrative housekeeping or deliberate execution. Without that context, Forfiles can be easy to dismiss as normal maintenance noise.

The attack pattern also fits broader living-off-the-land behavior seen in real intrusions, which is why The State of NHI & AI Agent Breach Report 2026 is useful background for understanding how legitimate tools are repurposed during compromise.

Risk and Threat Considerations

Forfiles is risky because it combines file selection and command execution in one place, which makes it useful for stealthy staging, scripted payload execution, and cleanup. The threat is not the utility itself, but the fact that it can execute attacker-controlled logic while looking like ordinary batch-file administration.

Failure mechanism: An attacker abuses file-pattern or age matching to find chosen artifacts, then uses Forfiles to hand those matches to a shell or script that runs payloads, alters files, or deletes evidence.

Impact: This can support malware launch, local persistence workflows, destructive cleanup, and harder-to-trace post-exploitation activity because the execution path is routed through a trusted Windows utility.

Practitioner Guidance

What to verify: Check the full parent-child chain, the command line, and the matched file scope before you decide the activity is benign. Forfiles launched from Office, script hosts, remote admin tools, or encoded command wrappers deserves immediate review.

Decision rule: If Forfiles is touching executable content, invoking a second interpreter, or operating on sensitive paths, treat it as potential attacker tradecraft until the operator can justify the exact maintenance task. If the command only matches a narrow, documented housekeeping pattern, preserve the evidence but lower the priority.

Practitioner takeaway: The key judgement is context, not the binary name alone, because Forfiles is dangerous when file discovery and execution are chained together inside a process path that should not normally need both.

Related resources from NHI Mgmt Group

• How do attackers use list planting?
• How do attackers use invisible Unicode?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?