> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/code-execution/t1202-forfiles-indirect-command-execution.md).

# Forfiles Indirect Command Execution

This technique launches an executable without a cmd.exe.

## Execution

```csharp
forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe
```

![](/files/-LJyjew_qABPxMBKiUUh)

## Observations

Defenders can monitor for process creation/commandline logs to detect this activity:

![](/files/-LJyjiHwchi8LNcGtPHw)

![](/files/-LJyjkBlj3iOlHGsmKq7)

## References

{% embed url="<https://attack.mitre.org/wiki/Technique/T1202>" %}