Procedure examples

HermeticWizard can use `cmd.exe` for execution on compromised hosts.

Covenant provides access to a Command Shell in Windows environments for follow-on command execution and tasking.

Diskpart can execute a disk partition script file, which attempts to mount a virtual hard disk. Diskpart can also assign and mount virtual disks.

SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.

Empire has modules for executing scripts.

PcShare can execute `cmd` commands on a compromised host.

AsyncRAT can be deployed via batch script.

Brute Ratel C4 can use cmd.exe for execution.

Remcos can launch a remote command line to execute commands on the victim’s machine.

Out1 can use native command line for execution.

MCMD can launch a console process (cmd.exe) with redirected standard input and output.

cmd is used to execute programs and other actions at the command-line interface.

Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.

QuasarRAT can launch a remote shell to execute commands on the victim’s machine.

KV Botnet Activity utilizes multiple Bash scripts during botnet installation stages, and the final botnet payload allows for running commands in the Bash shell.

During RedPenguin, UNC3886 used malware capable of launching an interactive shell.

During Operation MidnightEclipse, threat actors piped output from stdout to bash for execution.

During the 2025 Poland Wiper Attacks, the adversaries utilized the Linux `dd` command to overwrite portions of the disks with random data.

Quad7 Activity has enabled the creation of an access-controlled command shell /bin/sh on compromised routers.

FLORAHOX Activity has executed multiple Bash controller scripts to provide command line inputs for FLORAHOX traversal configurations.

Volt Typhoon has used Brightmetricagent.exe which contains a command- line interface (CLI) library that can leverage command shells including Z Shell (zsh).

APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.

TeamTNT has used shell scripts for execution.

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.

Scattered Spider has used the command shell to upload and install the Teleport remote access tool to a compromised vCenter Server Appliance.

UNC3886 has used a bash script to install malicious vSphere Installation Bundles (VIBs).

Contagious Interview has targeted macOS victim hosts using a bash downloader coremedia.sh and a bash script cloud.sh.

Sea Turtle used shell scripts for post-exploitation execution in victim environments.

Aquatic Panda used malicious shell scripts in Linux environments following access via SSH to install Linux versions of Winnti malware.

Velvet Ant used a custom tool, VELVETSTING, to parse encoded inbound commands to compromised F5 BIG-IP devices and then execute them via the Unix shell.

BRICKSTORM has executed shell commands using `/bin/sh`.

COATHANGER provides a BusyBox reverse shell for command and control.

WindTail can use the open command to execute an application.

Exaramel for Linux has a command to execute a shell command on the system.

CASTLETAP has the ability to spawn BusyBox command shell in victim environments.

NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.

The J-magic agent is executed through a command line argument which specifies an interface and listening port.

Gomir reads command line arguments and parses them for functionality when executed from a Linux shell, and can execute arbitrary strings passed to it as shell commands.

BOLDMOVE is capable of spawning a remote command shell.

Turian has the ability to use /bin/sh to execute commands.

Hildegard has used shell scripts for execution.

Cuckoo Stealer can spawn a bash shell to enable execution on compromised hosts.

Skidmap has used pm.sh to download and install its main payload.

REPTILE can deploy components automatically with shell scripts.

Doki has executed shell scripts with /bin/sh.

Fysbis has the ability to create and execute commands in a remote shell for CLI.

Kazuar uses /bin/bash to execute commands on the victim’s machine.

Green Lambert can use shell scripts for execution, such as /bin/sh -c.

SnappyTCP creates the reverse shell using a pthread spawning a bash shell.

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.