forfiles.exe

forfiles.exe iterates over a set of files matching criteria and runs a command (/c) for each match, substituting tokens like the file name. The command it runs can be any program, which is the behavior attackers repurpose: forfiles becomes the launcher, so the real command appears as a child of forfiles rather than of the script or shell. The genuine binary lives at C:\Windows\System32\forfiles.exe.

Legitimately, forfiles is used in cleanup and batch jobs, for example deleting files older than a certain date. The command it runs is what gives an instance meaning.

forfiles.exe is used for indirect command execution (T1202). By wrapping a payload in forfiles /p C:\ /m <file> /c "cmd /c <command>", an attacker has forfiles spawn the real command, so detections and parent-child rules that watch for a shell directly under an Office app or script host see forfiles in between instead. The command itself still runs, just one level removed.

Because forfiles is a legitimate maintenance tool, the /c command is what matters. forfiles launching a shell, a LOLBIN, or a download from a temp folder, especially under an unusual parent, is the case to examine.