Procedure examples

TDTESS provides a reverse shell on the victim.

SharpStage can execute arbitrary commands with the command line.

Sardonic has the ability to run `cmd.exe` or other interactive processes on a compromised computer.

Misdat is capable of providing shell functionality to the attacker to execute commands.

adbupd can run a copy of cmd.exe.

Emissary has the capability to create a remote shell and execute specified commands.

KEYMARBLE can execute shell commands using cmd.exe.

HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.

TAMECAT has used `cmd.exe` to run the `curl` command.

HeartCrypt can use the `reg add` command via `cmd.exe` for Registry modification.

RansomHub can use `cmd.exe` to execute multiple commands on infected hosts.

ZLib has the ability to execute shell commands.

RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.

Felismus uses command line for execution.

Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.

Havoc can execute commands via `cmd.exe`.

CARROTBAT has the ability to execute command line arguments on a compromised host.

GravityRAT executes commands remotely on the infected host.

WEBC2 can open an interactive command shell.

Bankshot uses the command-line interface to execute arbitrary commands.

SharpDisco can use `cmd.exe` to execute plugins and to send command output to specified SMB shares.

xCaon has a command to start an interactive shell.

PLAINTEE uses cmd.exe to execute commands on the victim’s machine.

Pony has used batch scripts to delete itself after execution.

Nebulae can use CMD to execute a process.

AuditCred can open a reverse shell on the system to execute commands.

TONESHELL has created a reverse shell using `cmd.exe`.

Kasidet can execute commands using cmd.exe.

Hannotog can execute various `cmd.exe /c %s` commands.

OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros.

Medusa Ransomware has used `cmd.exe` to execute command on an infected host.

RainyDay can use the Windows Command Shell for execution.

NETWIRE can issue commands using cmd.exe.

TinyTurla has been installed using a .bat file.

PyDCrypt has used `cmd.exe` for execution.

EnvyScout can use cmd.exe to execute malicious files on compromised hosts.

GreyEnergy uses cmd.exe to execute itself in-memory.

Emotet has used cmd.exe to run a PowerShell script.

SNUGRIDE is capable of executing commands and spawning a reverse shell.

Crimson has the ability to execute commands with the COMSPEC environment variable.

DUSTTRAP can execute commands via `cmd.exe`.

Turian can create a remote shell and execute commands using cmd.

BADHATCH can use `cmd.exe` to execute commands on a compromised host.

Action RAT can use `cmd.exe` to execute commands on an infected host.

PUBLOAD has used several commands executed in sequence via `cmd`.

SystemBC has used `cmd.exe` to execute VBS scripts, BAT scripts and CMD scripts.

PingPull can use `cmd.exe` to run various commands as a reverse shell.

WellMess can execute command line scripts received from C2.

DropBook can execute arbitrary shell commands on the victims' machines.

Woody RAT can execute commands using `cmd.exe`.