Forfiles — Malware Profile

Forfiles is a Windows utility commonly used in batch jobs to execute commands on one or more selected files or directories (ex: list all directories in a drive, read the first line of all files created yesterday, etc.). Forfiles can be executed from either the command line, Run window, or batch files/scripts.

MITRE ATT&CK techniques (3)

• T1005 Data from Local System
• T1083 File and Directory Discovery
• T1202 Indirect Command Execution

Attributed threat actors

• APT28

Read the full analysis on IntelFusions