Procedure examples

PyDCrypt has used `cmd.exe` for execution.

EnvyScout can use cmd.exe to execute malicious files on compromised hosts.

GreyEnergy uses cmd.exe to execute itself in-memory.

Emotet has used cmd.exe to run a PowerShell script.

SNUGRIDE is capable of executing commands and spawning a reverse shell.

Crimson has the ability to execute commands with the COMSPEC environment variable.

DUSTTRAP can execute commands via `cmd.exe`.

Turian can create a remote shell and execute commands using cmd.

BADHATCH can use `cmd.exe` to execute commands on a compromised host.

Action RAT can use `cmd.exe` to execute commands on an infected host.

PUBLOAD has used several commands executed in sequence via `cmd`.

SystemBC has used `cmd.exe` to execute VBS scripts, BAT scripts and CMD scripts.

PingPull can use `cmd.exe` to run various commands as a reverse shell.

WellMess can execute command line scripts received from C2.

DropBook can execute arbitrary shell commands on the victims' machines.

Woody RAT can execute commands using `cmd.exe`.

Mafalda can execute shell commands using `cmd.exe`.

Squirrelwaffle has used `cmd.exe` for execution.

Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet

AuTo Stealer can use `cmd.exe` to execute a created batch file.

ODAgent can execute a specified command line passed via API.

FlawedAmmyy has used `cmd` to execute commands on a compromised host.

SUGARUSH has used `cmd` for execution on an infected host.

HOPLIGHT can launch cmd.exe to execute commands on the system.

WastedLocker has used cmd to execute commands on the system.

InvisiMole can launch a remote shell to execute commands.

Volgmer can execute commands on the victim's machine.

WhisperGate can use `cmd.exe` to execute commands.

RDAT has executed commands using cmd.exe /c.

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.

SamSam uses custom batch scripts to execute some of its components.

Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.

Raspberry Robin uses cmd.exe to read and execute a file stored on an infected USB device as part of initial installation.

Megazord can execute multiple commands post infection via `cmd.exe`.

TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.

Siloscape can run cmd through an IRC channel.

BlackCat can execute commands on a compromised network with the use of `cmd.exe`.

UBoatRAT can start a command shell.

Nightdoor creates a cmd.exe shell to send and receive commands from the command and control server via open pipes.

HTTPTroy has the ability to generate a reverse shell using the command `conn <IP_ADDRESS> <PORT>`.

MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.

Kazuar uses cmd.exe to execute commands on the victim’s machine.

NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory.

DarkComet can launch a remote shell to execute commands on the victim’s machine.

NETEAGLE allows adversaries to execute shell commands on the infected host.

Ragnar Locker has used cmd.exe and batch scripts to execute commands.

Lucifer can issue shell commands to download and execute additional payloads.

zwShell can launch command-line shells.

Rising Sun has executed commands using `cmd.exe /c “<command> > <%temp%>\AM<random>. tmp” 2>&1`.

ShimRat can be issued a command shell function from the C2.