Forfiles

Forfiles is a Windows utility commonly used in batch jobs to execute commands on one or more selected files or directories (ex: list all directories in a drive, read the first line of all files created yesterday, etc.). Forfiles can be executed from either the command line, Run window, or batch files/scripts. [1]

ID: S0193
Type: TOOL
Contributors: Matthew Demaske, Adaptforward

Platforms: Windows

Version: 1.0

Techniques Used

DomainIDNameUse
EnterpriseT1005Data from Local SystemForfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).[2]
EnterpriseT1083File and Directory DiscoveryForfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)[2]
EnterpriseT1202Indirect Command ExecutionForfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd.[3][4]

Groups

Groups that use this software:

APT28

References