Forfiles.EXE Child Process Masquerading

Title: Forfiles.EXE Child Process Masquerading
Status: test
Description:Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.
References:
  -https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/
Author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati
Date: 2024-01-05
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1036'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentCommandLine|endswith:
      -'.exe'
      -'.exe"'

    Image|endswith: '\cmd.exe'
    CommandLine|startswith: '/c echo "'
  filter_main_parent_not_sys:
    ParentImage|contains:
      -':\Windows\System32\'
      -':\Windows\SysWOW64\'

    ParentImage|endswith: '\forfiles.exe'
    Image|contains:
      -':\Windows\System32\'
      -':\Windows\SysWOW64\'

    Image|endswith: '\cmd.exe'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high