Procedure examples

Metador has used the Windows command line to execute commands.

APT5 has used cmd.exe for execution on compromised systems.

Fox Kitten has used cmd.exe likely as a password changing mechanism.

Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.

INC Ransom has used `cmd.exe` to launch malicious payloads.

Silence has used Windows command-line to run commands.

Sowbug has used command line during its intrusions.

Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.

Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.

Wizard Spider has used `cmd.exe` to execute commands on a victim's machine.

Play has used a batch script to remove indicators of its presence on compromised hosts.

Rancor has used cmd.exe to execute commmands.

WIRTE has used the Windows command line as part of infection chains to open documents.

Magic Hound has used the command-line interface for code execution.

Threat Group-3390 has used command-line interfaces for execution.

FIN10 has executed malicious .bat files containing PowerShell commands.

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via `cmd.exe`.

FIN13 has leveraged `xp_cmdshell` and Windows Command Shell to execute commands on a compromised machine. FIN13 has also attempted to leverage the ‘xp_cmdshell’ SQL procedure to execute remote commands on internal MS-SQL servers.

Nomadic Octopus used cmd.exe /c within a malicious macro.

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.

PowerDuke runs cmd.exe /c and sends the output to its C2.

BLINDINGCAN has executed commands via cmd.exe.

Pikabot can execute Windows shell commands via cmd.exe.

Wiarp creates a backdoor through which remote attackers can open a command line interface.

RCSession can use `cmd.exe` for execution on compromised hosts.

Spark can use cmd.exe to run commands.

Bumblebee can use `cmd.exe` to drop and run files.

MURKYTOP uses the command-line interface.

Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.

Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c "<file_path> > %temp%\PM* .tmp 2>&1".

Orz can execute shell commands. Orz can execute commands with JavaScript.

IronWind has used the Windows command shell to execute malicious files.

SEASHARPEE can execute commands on victims.

POWRUNER can execute commands from its C2 server.

RobbinHood uses cmd.exe on the victim's computer.

TDTESS provides a reverse shell on the victim.

SharpStage can execute arbitrary commands with the command line.

Sardonic has the ability to run `cmd.exe` or other interactive processes on a compromised computer.

Misdat is capable of providing shell functionality to the attacker to execute commands.

adbupd can run a copy of cmd.exe.

Emissary has the capability to create a remote shell and execute specified commands.

KEYMARBLE can execute shell commands using cmd.exe.

HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.

TAMECAT has used `cmd.exe` to run the `curl` command.

HeartCrypt can use the `reg add` command via `cmd.exe` for Registry modification.

RansomHub can use `cmd.exe` to execute multiple commands on infected hosts.

ZLib has the ability to execute shell commands.

RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.

Felismus uses command line for execution.

Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.