Detects use of a Windows cmd.exe for /f loop with the delims= option to parse and extract data from the output of other commands. This technique is commonly employed to automate discovery, data extraction, or chained command execution, and can be used to evade simpler detections. The rule flags Windows endpoint processes whose parent process contains for /f and delims= patterns, excludes SYSTEM and other common legitimate contexts, and surfaces actionable fields for investigation. The detection is implemented as a Splunk search that leverages endpoint EDR telemetry (Sysmon EventID 1, CrowdStrike ProcessRollup2), maps data to the Endpoint data model, and aligns with MITRE ATT&CK technique T1059.003 (Command Shell). The rule supports incident response by highlighting anomalous command-line behaviors on Windows hosts, consistent with anomaly-focused detection and Living Off The Land or post-exploitation activity in Windows environments.