Procedure examples

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine. Additionally, APT38 has used batch scripts.

Indrik Spider has used batch scripts on victim's machines.

BlackByte executed ransomware using the Windows command shell.

GALLIUM used the Windows command shell to execute commands.

An APT3 downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.

Kimsuky has executed Windows commands by using `cmd` and running batch scripts. Kimsuky has also used `cmd.exe` to automatically open downloaded decoy pdf documents with the system’s default PDF viewer. Kimsuky has utilized malicious payloads to create reverse shells within the victim environment. Kimsuky has also used batch scripts to eventually run QuasarRAT.

TA577 has used BAT files in malware execution chains.

Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.

Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.

Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines.

APT41 used cmd.exe /c to execute commands on remote machines.
APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.

Dragonfly has used various types of scripting to perform operations, including batch scripts.

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.

APT32 has used cmd.exe for execution.

HAFNIUM has used `cmd.exe` to execute commands on the victim's machine.

MuddyWater has used a custom tool for creating reverse shells.

FIN6 has used kill.bat script to disable security tools.

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.

Storm-1811 has used multiple batch scripts during initial access and subsequent actions on victim machines.

TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.

FIN7 used the command prompt to launch commands on the victim’s machine. Additionally, FIN7 has used cmd.exe to open the Run dialog by sending the “Windows + R” keys through malicious USBs acting as virtual keyboards.

Machete has used batch files to initiate additional downloads of malicious files.

APT18 uses cmd.exe to execute commands on the victim’s machine.

Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection. Mustang Panda has also utilized cmd.exe to execute commands on an infected host such as `cmd.exe /c ping.exe 8.8.8.8 -n 70&&"%temp%\FontEDL.exe"`.

ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.

UNC3886 has executed Windows commands on guest virtual machines through `vmtoolsd.exe`.

Contagious Interview has utilized VBS scripts to open cmd.exe and run commands to include the go_batch.bat batch file.

APT37 has used the command-line interface.

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.

Higaisa used cmd.exe for execution.

Tropic Trooper has used Windows command scripts.

Several tools used by Suckfly have been command-line driven.

Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to cmd /C.

Ke3chang has used batch scripts in its malware to install persistence mechanisms.

Saint Bear initial loaders will also drop a malicious Windows batch file, available via open source GitHub repositories, that disables Microsoft Defender functionality.

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.

Blue Mockingbird has used batch script files to automate execution and deployment of payloads.

Winter Vivern distributed Windows batch scripts disguised as virus scanners to prompt download of malicious payloads using built-in system tools.

Turla RPC backdoors have used cmd.exe to execute commands.

TA505 has executed commands using cmd.exe.

RedCurl has used the Windows Command Prompt to execute commands.

Dark Caracal has used macros in Word documents that would download a second stage if executed.

Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO.

Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.

MirrorFace has used `cmd.exe` for malware execution, file discovery, and manual file manipulation.

Medusa Group has used Windows Command Prompt to control and execute commands on the system to include ingress, network, and filesystem enumeration activities.

BRONZE BUTLER has used batch scripts and the command-line interface for execution.

TA551 has used cmd.exe to execute commands.

Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.