Suspicious Usage of For Loop with Recursive Directory Search in CMD

Joseliyo Sanchez, @Joseliyo_Jstnk

Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files.

2025-11-12 00:00:00

None

2782fbd8-b662-4eb5-9962-5bfbfb671e7b

attack.execution attack.t1059.003 attack.defense-evasion attack.t1027.010

Community Rule

jstnk9

Merge PR #5519 from @jstnk9 - Suspicious Use of for Loop with Directory Search in CMD

2025-11-21