Procedure examples

Hikit has the ability to create a remote shell and run given commands.

StrelaStealer has included BAT files in some instances for installation.

Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.

Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.

Shark has the ability to use `CMD` to execute commands.

Bazar can launch cmd.exe to perform reconnaissance commands.

RATANKBA uses cmd.exe to execute commands.

hcdLoader provides command-line access to the compromised system.

MoonWind can execute commands via an interactive command shell. MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.

Ryuk has used cmd.exe to create a Registry entry to establish persistence.

HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.

ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.

ccf32 has used `cmd.exe` for archiving data and deleting files.

Kapeka allows for arbitrary Windows command execution.

LockBit 2.0 can use the Windows command shell for multiple post-compromise actions on objective.

Zebrocy uses cmd.exe to execute commands on the system.

Cobalt Strike uses a command-line interface to interact with systems.

SampleCheck5000 can call cmd.exe to execute C2 command line strings.

EvilBunny has an integrated scripting engine to download and execute Lua scripts.

Cobian RAT can launch a remote command shell interface for executing commands.

HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.

ServHelper can execute shell commands against cmd.

JCry has used cmd.exe to launch PowerShell.

REvil can use the Windows command line to delete volume shadow copies and disable recovery.

Samurai can use a remote command module for execution via the Windows command line.

Milan can use `cmd.exe` for discovery actions on a targeted system.

OilBooster has the ability to execute shell commands and exfiltrate the results.

Taidoor can copy cmd.exe into the system temp folder.

PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.

Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.

NanoCore can open a remote command-line interface and execute commands. NanoCore uses JavaScript files.

PLEAD has the ability to execute shell commands on the compromised host.

IPsec Helper can run arbitrary commands passed to it through cmd.exe.

Daserf can execute shell commands.

Cardinal RAT can execute commands.

DanBot has the ability to execute arbitrary commands via `cmd.exe`.

BISCUIT has a command to launch a command shell on the system.

Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.

GoldenSpy can execute remote commands via the command-line interface.

Gold Dragon uses cmd.exe to execute commands for discovery.

RGDoor uses cmd.exe to execute commands on the victim’s machine.

HARDRAIN uses cmd.exe to execute netshcommands.

Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.

FunnyDream can use `cmd.exe` for execution on remote hosts.

ROADSWEEP can open cmd.exe to enable command execution.

More_eggs has used cmd.exe for execution.

TinyZBot supports execution from the command-line.

OutSteel has used `cmd.exe` to scan a compromised host for specific file extensions.

BackConfig can download and run batch files to execute commands on a compromised host.

DEADEYE can run `cmd /c copy /y /b C:\Users\public\syslog_6-*.dat C:\Users\public\syslog.dll` to combine separated sections of code into a single DLL prior to execution.