Procedure examples

Dark Caracal has used macros in Word documents that would download a second stage if executed.

Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO.

Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.

MirrorFace has used `cmd.exe` for malware execution, file discovery, and manual file manipulation.

Medusa Group has used Windows Command Prompt to control and execute commands on the system to include ingress, network, and filesystem enumeration activities.

BRONZE BUTLER has used batch scripts and the command-line interface for execution.

TA551 has used cmd.exe to execute commands.

Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.

LazyScripter has used batch files to deploy open-source and multi-stage RATs.

ToddyCat has used .bat scripts and `cmd` for execution on compromised hosts.

Agrius uses ASPXSpy web shells to enable follow-on command execution via cmd.exe.

An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.

Metador has used the Windows command line to execute commands.

APT5 has used cmd.exe for execution on compromised systems.

Fox Kitten has used cmd.exe likely as a password changing mechanism.

Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.

INC Ransom has used `cmd.exe` to launch malicious payloads.

Silence has used Windows command-line to run commands.

Sowbug has used command line during its intrusions.

Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.

Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.

Wizard Spider has used `cmd.exe` to execute commands on a victim's machine.

Play has used a batch script to remove indicators of its presence on compromised hosts.

Rancor has used cmd.exe to execute commmands.

WIRTE has used the Windows command line as part of infection chains to open documents.

Magic Hound has used the command-line interface for code execution.

Threat Group-3390 has used command-line interfaces for execution.

FIN10 has executed malicious .bat files containing PowerShell commands.

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via `cmd.exe`.

FIN13 has leveraged `xp_cmdshell` and Windows Command Shell to execute commands on a compromised machine. FIN13 has also attempted to leverage the ‘xp_cmdshell’ SQL procedure to execute remote commands on internal MS-SQL servers.

Nomadic Octopus used cmd.exe /c within a malicious macro.

Volt Typhoon has used Brightmetricagent.exe which contains a command- line interface (CLI) library that can leverage command shells including Z Shell (zsh).

APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.

TeamTNT has used shell scripts for execution.

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.

Scattered Spider has used the command shell to upload and install the Teleport remote access tool to a compromised vCenter Server Appliance.

UNC3886 has used a bash script to install malicious vSphere Installation Bundles (VIBs).

Contagious Interview has targeted macOS victim hosts using a bash downloader coremedia.sh and a bash script cloud.sh.

Sea Turtle used shell scripts for post-exploitation execution in victim environments.

Aquatic Panda used malicious shell scripts in Linux environments following access via SSH to install Linux versions of Winnti malware.

Velvet Ant used a custom tool, VELVETSTING, to parse encoded inbound commands to compromised F5 BIG-IP devices and then execute them via the Unix shell.

TeamPCP has leveraged malware capable of execution via the Linux CLI.

APT38 has used VBScript to execute commands and other operational tasks.

SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.

Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure. Kimsuky has also leveraged VBScript (VBS) scripts to execute temp.vbs every 19 minutes using a scheduled task to run QuasarRAT.

Patchwork used Visual Basic Scripts (VBS) on victim machines.

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.

APT32 has used macros, COM scriptlets, and VBS scripts.

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros. Additionally, Gamaredon Group has executed VBScript files using wscript.exe.