{"id":"2782fbd8-b662-4eb5-9962-5bfbfb671e7b","title":"Suspicious Usage of For Loop with Recursive Directory Search in CMD","description":"Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing.\nThis pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection.\nThis behavior has been observed in various malicious lnk files.\n","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"experimental","level":"medium","date":"2025-11-12","modified":"","tags":["attack.execution","attack.stealth","attack.t1059.003","attack.t1027.010"],"technique_ids":["T1027.010","T1059.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_cmd_for_loop_execution_with_recursive_directory_search.yml","source_sha256":"2e05405192e1abcc63bb5ecd296a1ffb58d0ba864b11fbef0a540f00b8d66f0c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_cmd_for_loop_execution_with_recursive_directory_search.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Usage of For Loop with Recursive Directory Search in CMD\nid: 2782fbd8-b662-4eb5-9962-5bfbfb671e7b\nstatus: experimental\ndescription: |\n    Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing.\n    This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection.\n    This behavior has been observed in various malicious lnk files.\nreferences:\n    - https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2025-11-12\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.003\n    - attack.t1027.010\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_tokens:\n        CommandLine|contains|all:\n            - 'for /f'\n            - 'tokens='\n            - 'in ('\n            - 'dir'\n    selection_tokens_parent:\n        ParentCommandLine|contains|all:\n            - 'for /f'\n            - 'tokens='\n            - 'in ('\n            - 'dir'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.010","id":"T1027.010","name":"Command Obfuscation","page":"techniques/enterprise/T1027.010/"},{"key":"enterprise/T1059.003","id":"T1059.003","name":"Windows Command Shell","page":"techniques/enterprise/T1059.003/"}],"data_path":"data/detection-rules/2782fbd8-b662-4eb5-9962-5bfbfb671e7b.json","kind":"sigma"}