Procedure examples

Meteor can run `set.bat`, `update.bat`, `cache.bat`, `bcd.bat`, `msrun.bat`, and similar scripts.

njRAT can launch a command shell interface for executing commands.

The Maze encryption process has used batch scripts with various commands.

ComRAT has used cmd.exe to execute commands.

TURNEDUP is capable of creating a reverse shell.

Manjusaka can execute arbitrary commands passed to it from the C2 controller via `cmd.exe /c`.

JPIN can use the command-line utility cacls.exe to change file permissions.

SideTwist can execute shell commands on a compromised host.

KOCTOPUS has used `cmd.exe` and batch files for execution.

MechaFlounder has the ability to run commands on a compromised host.

HTTPBrowser is capable of spawning a reverse shell on a victim.

Mis-Type has used `cmd.exe` to run commands on a compromised host.

LunarWeb can run shell commands using a BAT file with a name matching `%TEMP%\<⁠random_9_alnum_chars>.batfile` or through cmd.exe with the `/c` and `/U` option for Unicode output.

Dipsind can spawn remote shells.

Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i
C:\Users\xxx\<encryptor_1>.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.

STARWHALE has the ability to execute commands via `cmd.exe`.

MirageFox has the capability to execute commands using cmd.exe.

DownPaper uses the command line.

A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.

Kevin can use a renamed image of `cmd.exe` for execution.

httpclient opens cmd.exe on the victim.

ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.

BADNEWS is capable of executing commands via cmd.exe.

Linfo creates a backdoor through which remote attackers can start a remote shell.

Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.

Remexi silently executes received commands with cmd.exe.

Astaroth spawns a CMD process to execute commands.

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.

SYSCON has the ability to execute commands through cmd on a compromised host.

Gelsemium can use a batch script to delete itself.

jRAT has command line access.

Helminth can provide a remote shell. One version of Helminth uses batch scripting.

BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.

Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.

Comnie executes BAT scripts.

PHOREAL is capable of creating reverse shell.

Lizar has a command to open the command-line on the infected system.

Dtrack has used cmd.exe to add a persistent service.

H1N1 kills and disables services by using cmd.exe.

Seth-Locker can execute commands via the command line shell.

LoudMiner used a batch script to run the Linux virtual machine as a service.

Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.

UPPERCUT uses cmd.exe to execute commands on the victim’s machine.

ADVSTORESHELL can create a remote shell and run a given command.

StrifeWater can execute shell commands using `cmd.exe`.

Mivast has the capability to open a remote shell and run basic commands.

HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.

WarzoneRAT can use `cmd.exe` to execute malicious code.

SLOTHFULMEDIA can open a command line to execute commands.

Small Sieve can use `cmd.exe` to execute commands on a victim's system.