Sigma rule: Suspicious Usage of For Loop with Recursive Directory Search in CMD

Rule

Title

Suspicious Usage of For Loop with Recursive Directory Search in CMD

Status

experimental

Level

medium

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Date

2025-11-12

File

rules/windows/process_creation/proc_creation_win_susp_cmd_for_loop_execution_with_recursive_directory_search.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing.
This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection.
This behavior has been observed in various malicious lnk files.

Log source

product

windows

category

process_creation

Detection

selection_tokens:
    CommandLine|contains|all:
        - 'for /f'
        - 'tokens='
        - 'in ('
        - 'dir'
selection_tokens_parent:
    ParentCommandLine|contains|all:
        - 'for /f'
        - 'tokens='
        - 'in ('
        - 'dir'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.stealth
• attack.t1059.003
• attack.t1027.010

MITRE ATT&CK ids this rule names

• T1027.010
• T1059.003

References

• https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_cmd_for_loop_execution_with_recursive_directory_search.yml