Procedure examples

Mafalda can execute shell commands using `cmd.exe`.

Squirrelwaffle has used `cmd.exe` for execution.

Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet

AuTo Stealer can use `cmd.exe` to execute a created batch file.

ODAgent can execute a specified command line passed via API.

FlawedAmmyy has used `cmd` to execute commands on a compromised host.

SUGARUSH has used `cmd` for execution on an infected host.

HOPLIGHT can launch cmd.exe to execute commands on the system.

WastedLocker has used cmd to execute commands on the system.

InvisiMole can launch a remote shell to execute commands.

Volgmer can execute commands on the victim's machine.

WhisperGate can use `cmd.exe` to execute commands.

RDAT has executed commands using cmd.exe /c.

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.

SamSam uses custom batch scripts to execute some of its components.

Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.

Raspberry Robin uses cmd.exe to read and execute a file stored on an infected USB device as part of initial installation.

Megazord can execute multiple commands post infection via `cmd.exe`.

TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.

Siloscape can run cmd through an IRC channel.

BlackCat can execute commands on a compromised network with the use of `cmd.exe`.

UBoatRAT can start a command shell.

Nightdoor creates a cmd.exe shell to send and receive commands from the command and control server via open pipes.

HTTPTroy has the ability to generate a reverse shell using the command `conn <IP_ADDRESS> <PORT>`.

MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.

Kazuar uses cmd.exe to execute commands on the victim’s machine.

NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory.

DarkComet can launch a remote shell to execute commands on the victim’s machine.

NETEAGLE allows adversaries to execute shell commands on the infected host.

Ragnar Locker has used cmd.exe and batch scripts to execute commands.

Lucifer can issue shell commands to download and execute additional payloads.

zwShell can launch command-line shells.

Rising Sun has executed commands using `cmd.exe /c “<command> > <%temp%>\AM<random>. tmp” 2>&1`.

ShimRat can be issued a command shell function from the C2.

Flagpro can use `cmd.exe` to execute commands received from C2.

Hi-Zor has the ability to create a reverse shell.

China Chopper's server component is capable of opening a command terminal.

CALENDAR has a command to run cmd.exe to execute commands.

GoldMax can spawn a command shell, and execute native commands.

KeyBoy can launch interactive shells for communicating with the victim machine.

Anchor has used cmd.exe to run its self deletion routine.

Pteranodon can use `cmd.exe` for execution on victim systems.

DarkTortilla can use `cmd.exe` to add registry keys for persistence.

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.

Babuk has the ability to use the command line to control execution on compromised hosts.

DarkWatchman can use `cmd.exe` to execute commands.

BlackMould can run cmd.exe with parameters.

PlugX allows actors to spawn a reverse shell on a victim.

Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.

MultiLayer Wiper uses a batch script launched via a scheduled task to delete Windows Event Logs.