Elastic medium stable eql

Command Execution via ForFiles

Detects attempts to execute a command via the forfiles Windows utility. Adversaries may use this utility to proxy execution via a trusted parent process.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and user.id != "S-1-5-18" and
 (process.name : "forfiles.exe" or ?process.pe.original_file_name == "forfiles.exe") and process.args : ("/c", "-c") and
 not process.args : ("-d", "/d", "cmd /c copy @file*", "cmd /c DEL /Q /F @*", "cmd /c del @*", "D:\\*")

Field Validations

Loading…

Comments (0)

Loading comments...