Procedure examples

Kevin can use a renamed image of `cmd.exe` for execution.

httpclient opens cmd.exe on the victim.

ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.

BADNEWS is capable of executing commands via cmd.exe.

Linfo creates a backdoor through which remote attackers can start a remote shell.

Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.

Remexi silently executes received commands with cmd.exe.

Astaroth spawns a CMD process to execute commands.

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.

SYSCON has the ability to execute commands through cmd on a compromised host.

Gelsemium can use a batch script to delete itself.

jRAT has command line access.

Helminth can provide a remote shell. One version of Helminth uses batch scripting.

BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.

Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.

Comnie executes BAT scripts.

PHOREAL is capable of creating reverse shell.

Lizar has a command to open the command-line on the infected system.

Dtrack has used cmd.exe to add a persistent service.

H1N1 kills and disables services by using cmd.exe.

Seth-Locker can execute commands via the command line shell.

LoudMiner used a batch script to run the Linux virtual machine as a service.

Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.

UPPERCUT uses cmd.exe to execute commands on the victim’s machine.

ADVSTORESHELL can create a remote shell and run a given command.

StrifeWater can execute shell commands using `cmd.exe`.

Mivast has the capability to open a remote shell and run basic commands.

HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.

WarzoneRAT can use `cmd.exe` to execute malicious code.

SLOTHFULMEDIA can open a command line to execute commands.

Small Sieve can use `cmd.exe` to execute commands on a victim's system.

HermeticWizard can use `cmd.exe` for execution on compromised hosts.

Covenant provides access to a Command Shell in Windows environments for follow-on command execution and tasking.

Diskpart can execute a disk partition script file, which attempts to mount a virtual hard disk. Diskpart can also assign and mount virtual disks.

SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.

Empire has modules for executing scripts.

PcShare can execute `cmd` commands on a compromised host.

AsyncRAT can be deployed via batch script.

Brute Ratel C4 can use cmd.exe for execution.

Remcos can launch a remote command line to execute commands on the victim’s machine.

Out1 can use native command line for execution.

MCMD can launch a console process (cmd.exe) with redirected standard input and output.

cmd is used to execute programs and other actions at the command-line interface.

Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.

QuasarRAT can launch a remote shell to execute commands on the victim’s machine.