Procedure examples

The Latrodectus command handler can use `cmdexe` to run multiple discovery commands.

Saint Bot has used `cmd.exe` and `.bat` scripts for execution.

Chaes has used cmd to execute tasks on the system.

The C# implementation of the CharmPower command execution module can use cmd.

MuddyViper has used cmd.exe to launch a reverse shell.

TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell.

KOMPROGO is capable of creating a reverse shell.

QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.

TAINTEDSCRIBE can enable Windows CLI access and execute files.

Uroburos has the ability to use the command line for execution on the targeted system.

Metamorfo has used cmd.exe /c to execute files.

Embargo has utilized a BAT script to disable security solutions.

Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.

Bandook is capable of spawning a Windows command shell.

MagicRAT allows for the execution of arbitrary commands on the victim system.

KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.

DnsSystem can use `cmd.exe` for execution.

MoleNet can execute commands via the command line utility.

JHUHUGIT uses a .bat file to execute a .dll.

KGH_SPY has the ability to set a Registry key to run a cmd.exe command.

Ixeshe is capable of executing commands via cmd.

Micropsia creates a command-line shell using cmd.exe.

RedLine Stealer has executed windows cmd using `ErrorHandler.cmd` to create scheduled tasks.

Black Basta can use `cmd.exe` to enable shadow copy deletion.

OopsIE uses the command prompt to execute commands on the victim's machine.

4H RAT has the capability to create a remote shell.

RogueRobin uses Windows Script Components.

DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.

SQLRat has used SQL to execute JavaScript and VB scripts on the host system.

MegaCortex has used .cmd scripts on the victim's system.

StreamEx has the ability to remotely execute commands.

BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.

SDBbot has the ability to use the command shell to execute commands on a compromised host.

Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.

RTM uses the command line and rundll32.exe to execute.

Hikit has the ability to create a remote shell and run given commands.

StrelaStealer has included BAT files in some instances for installation.

Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.

Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.

Shark has the ability to use `CMD` to execute commands.

Bazar can launch cmd.exe to perform reconnaissance commands.

RATANKBA uses cmd.exe to execute commands.

hcdLoader provides command-line access to the compromised system.

MoonWind can execute commands via an interactive command shell. MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.

Ryuk has used cmd.exe to create a Registry entry to establish persistence.

HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.

ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.

ccf32 has used `cmd.exe` for archiving data and deleting files.

Kapeka allows for arbitrary Windows command execution.

LockBit 2.0 can use the Windows command shell for multiple post-compromise actions on objective.