Procedure examples

During the 2015 Ukraine Electric Power Attack, Sandworm Team gathered account credentials via a BlackEnergy keylogger plugin.

During Cutting Edge, threat actors modified a JavaScript file on the Web SSL VPN component of Ivanti Connect Secure devices to keylog credentials.

During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.

In the Triton Safety Instrumented System Attack, TEMP.Veles captured credentials as they were being changed by redirecting text-based login codes to websites they controlled.

During Cutting Edge, threat actors modified the JavaScript loaded by the Ivanti Connect Secure login page to capture credentials entered.

Scripts associated with KV Botnet Activity initial deployment can identify processes related to security tools and other botnet families for follow-on disabling during installation.

During Frankenstein, the threat actors used Empire to obtain a list of all running processes.

During RedPenguin, UNC3886 used malware capable of reading the PID for the Junos OS snmpd daemon.

During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.

During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.

During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.

During FunnyDream, the threat actors used Tasklist on targeted systems.

During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.

During the 2025 Poland Wiper Attacks, the adversaries enumerated current running processes using `tasklist`.

During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.

For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.

During Cutting Edge, threat actors used Perl scripts to enable the deployment of the THINSPOOL shell script dropper and for enumerating host data.

ArcaneDoor included the adversary executing command line interface (CLI) commands.

FLORAHOX Activity has executed PHP and Shell scripts to identify and infect subsequent routers for the ORB network.

During Operation Dream Job, Lazarus Group used PowerShell commands to explore the environment of compromised victims.

During SharePoint ToolShell Exploitation, threat actors used PowerShell to execute attacker-controlled encoded commands.

During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts.

Mustang Panda used LNK files to execute PowerShell commands leading to eventual PlugX installation during RedDelta Modified PlugX Infection Chain Operations.

In the Triton Safety Instrumented System Attack, TEMP.Veles used a publicly available PowerShell-based tool, WMImplant.

During C0018, the threat actors used encoded PowerShell scripts for execution.

During C0021, the threat actors used obfuscated PowerShell to extract an encoded payload from within an .LNK file.

During Juicy Mix, OilRig used a PowerShell script to steal credentials.

During HomeLand Justice, threat actors used PowerShell cmdlets New-MailboxSearch and Get-Recipient for discovery.

During the C0032 campaign, TEMP.Veles used PowerShell to perform timestomping.

During the SolarWinds Compromise, APT29 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.

Pikabot Distribution February 2024 passed execution from obfuscated JavaScript files to PowerShell scripts to download and install Pikabot.

During Operation AkaiRyū, MirrorFace used PowerShell in execution chains to drop additional files such as embedded CAB files.

During APT28 Nearest Neighbor Campaign, APT28 used PowerShell cmdlet Get-ChildItem to access credentials, among other PowerShell functions deployed.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.

During Operation Wocao, threat actors used PowerShell on compromised systems.

During the 2022 Ukraine Electric Power Attack, Sandworm Team utilized a PowerShell utility called TANKTRAP to spread and launch a wiper using Windows Group Policy.

During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.

During SharePoint ToolShell Exploitation, threat actors utilized `cmd.exe` and batch scripts within the victim environment.

During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line

During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.

Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe.

During Operation Digital Eye, threat actors used `cmd.exe` as a default method of execution for a custom version of Mimikatz named bK2o.exe.

During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.

During HomeLand Justice, threat actors used Windows batch files for persistence and execution.

During the SolarWinds Compromise, APT29 used `cmd.exe` to execute commands on remote machines.

During Operation AkaiRyū, MirrorFace used `cmd.exe` to run PowerShell commands to drop additional files on the compromised host.

During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.

During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.

During APT28 Nearest Neighbor Campaign, APT28 used cmd.exe for execution.

During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run `cmd.exe` commands on multiple victim machines.