Procedure examples

Havoc can execute commands via `cmd.exe`.

CARROTBAT has the ability to execute command line arguments on a compromised host.

GravityRAT executes commands remotely on the infected host.

WEBC2 can open an interactive command shell.

Bankshot uses the command-line interface to execute arbitrary commands.

SharpDisco can use `cmd.exe` to execute plugins and to send command output to specified SMB shares.

xCaon has a command to start an interactive shell.

PLAINTEE uses cmd.exe to execute commands on the victim’s machine.

Pony has used batch scripts to delete itself after execution.

Nebulae can use CMD to execute a process.

AuditCred can open a reverse shell on the system to execute commands.

TONESHELL has created a reverse shell using `cmd.exe`.

Kasidet can execute commands using cmd.exe.

Hannotog can execute various `cmd.exe /c %s` commands.

OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros.

Medusa Ransomware has used `cmd.exe` to execute command on an infected host.

RainyDay can use the Windows Command Shell for execution.

NETWIRE can issue commands using cmd.exe.

TinyTurla has been installed using a .bat file.

PyDCrypt has used `cmd.exe` for execution.

EnvyScout can use cmd.exe to execute malicious files on compromised hosts.

GreyEnergy uses cmd.exe to execute itself in-memory.

Emotet has used cmd.exe to run a PowerShell script.

SNUGRIDE is capable of executing commands and spawning a reverse shell.

Crimson has the ability to execute commands with the COMSPEC environment variable.

DUSTTRAP can execute commands via `cmd.exe`.

Turian can create a remote shell and execute commands using cmd.

BADHATCH can use `cmd.exe` to execute commands on a compromised host.

Action RAT can use `cmd.exe` to execute commands on an infected host.

PUBLOAD has used several commands executed in sequence via `cmd`.

SystemBC has used `cmd.exe` to execute VBS scripts, BAT scripts and CMD scripts.

PingPull can use `cmd.exe` to run various commands as a reverse shell.

WellMess can execute command line scripts received from C2.

DropBook can execute arbitrary shell commands on the victims' machines.

Woody RAT can execute commands using `cmd.exe`.

Mafalda can execute shell commands using `cmd.exe`.

Squirrelwaffle has used `cmd.exe` for execution.

Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet

AuTo Stealer can use `cmd.exe` to execute a created batch file.

ODAgent can execute a specified command line passed via API.

FlawedAmmyy has used `cmd` to execute commands on a compromised host.

SUGARUSH has used `cmd` for execution on an infected host.

HOPLIGHT can launch cmd.exe to execute commands on the system.

WastedLocker has used cmd to execute commands on the system.

InvisiMole can launch a remote shell to execute commands.

Volgmer can execute commands on the victim's machine.

WhisperGate can use `cmd.exe` to execute commands.

RDAT has executed commands using cmd.exe /c.

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.

SamSam uses custom batch scripts to execute some of its components.