Procedure examples

Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.

Raspberry Robin uses cmd.exe to read and execute a file stored on an infected USB device as part of initial installation.

Megazord can execute multiple commands post infection via `cmd.exe`.

TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.

Siloscape can run cmd through an IRC channel.

BlackCat can execute commands on a compromised network with the use of `cmd.exe`.

UBoatRAT can start a command shell.

Nightdoor creates a cmd.exe shell to send and receive commands from the command and control server via open pipes.

HTTPTroy has the ability to generate a reverse shell using the command `conn <IP_ADDRESS> <PORT>`.

MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.

Kazuar uses cmd.exe to execute commands on the victim’s machine.

NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory.

DarkComet can launch a remote shell to execute commands on the victim’s machine.

NETEAGLE allows adversaries to execute shell commands on the infected host.

Ragnar Locker has used cmd.exe and batch scripts to execute commands.

Lucifer can issue shell commands to download and execute additional payloads.

zwShell can launch command-line shells.

Rising Sun has executed commands using `cmd.exe /c “<command> > <%temp%>\AM<random>. tmp” 2>&1`.

ShimRat can be issued a command shell function from the C2.

Flagpro can use `cmd.exe` to execute commands received from C2.

Hi-Zor has the ability to create a reverse shell.

China Chopper's server component is capable of opening a command terminal.

CALENDAR has a command to run cmd.exe to execute commands.

GoldMax can spawn a command shell, and execute native commands.

KeyBoy can launch interactive shells for communicating with the victim machine.

Anchor has used cmd.exe to run its self deletion routine.

Pteranodon can use `cmd.exe` for execution on victim systems.

DarkTortilla can use `cmd.exe` to add registry keys for persistence.

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.

Babuk has the ability to use the command line to control execution on compromised hosts.

DarkWatchman can use `cmd.exe` to execute commands.

BlackMould can run cmd.exe with parameters.

PlugX allows actors to spawn a reverse shell on a victim.

Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.

MultiLayer Wiper uses a batch script launched via a scheduled task to delete Windows Event Logs.

S-Type has provided the ability to execute shell commands on a compromised host.

SeaDuke is capable of executing commands.

LightNeuron is capable of executing commands via cmd.exe.

Peppy has the ability to execute shell commands.

Cuba has used cmd.exe /c and batch files for execution.

Clambling can use cmd.exe for command execution.

Akira executes from the Windows command line and can take various arguments for execution.

DarkGate uses a malicious Windows Batch script to run the Windows code utility to retrieve follow-on script payloads. DarkGate has also used `cmd.exe` to create a remote shell.

Carbanak has a command to create a reverse shell.

XTunnel has been used to execute remote commands.

HOMEFRY uses a command-line interface.

Caterpillar WebShell can run commands on the compromised asset with CMD functions.

Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.

USBferry can execute various Windows commands.

TSCookie has the ability to execute shell commands on the infected host.