Generalising file paths and urls, see #10 (#422)

yml/OSBinaries/Forfiles.yml

@@ -1,11 +1,11 @@
 ---
 Name: Forfiles.exe
 Description: Selects and executes a command on a file or set of files. This command is useful for batch processing.
-Author: 'Oddvar Moe'
+Author: Oddvar Moe
 Created: 2018-05-25
 Commands:
-  - Command: forfiles /p c:\windows\system32 /m notepad.exe /c calc.exe
-    Description: Executes calc.exe since there is a match for notepad.exe in the c:\windows\System32 folder.
+  - Command: forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"
+    Description: Executes specified command since there is a match for notepad.exe in the c:\windows\System32 folder.
     Usecase: Use forfiles to start a new process to evade defensive counter measures
     Category: Execute
     Privileges: User
@@ -13,7 +13,7 @@ Commands:
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
     Tags:
       - Execute: EXE
-  - Command: forfiles /p c:\windows\system32 /m notepad.exe /c "c:\folder\normal.dll:evil.exe"
+  - Command: forfiles /p c:\windows\system32 /m notepad.exe /c "{PATH_ABSOLUTE}:evil.exe"
     Description: Executes the evil.exe Alternate Data Stream (AD) since there is a match for notepad.exe in the c:\windows\system32 folder.
     Usecase: Use forfiles to start a new process from a binary hidden in an alternate data stream
     Category: ADS
@@ -25,8 +25,6 @@ Commands:
 Full_Path:
   - Path: C:\Windows\System32\forfiles.exe
   - Path: C:\Windows\SysWOW64\forfiles.exe
-Code_Sample:
-  - Code:
 Detection:
   - Sigma: https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_forfiles.yml
 Resources: