Procedure examples

LAMEHUG can use `cmd.exe` to display a decoy file to spearphishing victims.

InnaputRAT launches a shell to execute commands on the victim’s machine.

GrimAgent can use the Windows Command Shell to execute commands, including its own removal.

LookBack executes the cmd.exe command.

Clop can use cmd.exe to help execute commands on the system.

Lokibot has used cmd /c commands embedded within batch scripts.

Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.

PoetRAT has called cmd through a Word document macro.

FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.

ZxShell can launch a reverse command shell.

CoinTicker executes a bash script to establish a reverse shell.

BabyShark has used cmd.exe to execute commands.

BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.

Troll Stealer can create and execute Windows batch scripts.

BLACKCOFFEE has the capability to create a reverse shell.

Meteor can run `set.bat`, `update.bat`, `cache.bat`, `bcd.bat`, `msrun.bat`, and similar scripts.

njRAT can launch a command shell interface for executing commands.

The Maze encryption process has used batch scripts with various commands.

ComRAT has used cmd.exe to execute commands.

TURNEDUP is capable of creating a reverse shell.

Manjusaka can execute arbitrary commands passed to it from the C2 controller via `cmd.exe /c`.

JPIN can use the command-line utility cacls.exe to change file permissions.

SideTwist can execute shell commands on a compromised host.

KOCTOPUS has used `cmd.exe` and batch files for execution.

MechaFlounder has the ability to run commands on a compromised host.

HTTPBrowser is capable of spawning a reverse shell on a victim.

Mis-Type has used `cmd.exe` to run commands on a compromised host.

LunarWeb can run shell commands using a BAT file with a name matching `%TEMP%\<⁠random_9_alnum_chars>.batfile` or through cmd.exe with the `/c` and `/U` option for Unicode output.

Dipsind can spawn remote shells.

Qilin has run `cmd /C [PsExec] -accepteula \\IP Address -c -f -h -d -i
C:\Users\xxx\<encryptor_1>.exe --password [PASSWORD] --spread --spread-process` to execute its encryptor to target multiple network shares.

STARWHALE has the ability to execute commands via `cmd.exe`.

MirageFox has the capability to execute commands using cmd.exe.

DownPaper uses the command line.

A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.

Kevin can use a renamed image of `cmd.exe` for execution.

httpclient opens cmd.exe on the victim.

ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.

BADNEWS is capable of executing commands via cmd.exe.

Linfo creates a backdoor through which remote attackers can start a remote shell.

Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.

Remexi silently executes received commands with cmd.exe.

Astaroth spawns a CMD process to execute commands.

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.

SYSCON has the ability to execute commands through cmd on a compromised host.

Gelsemium can use a batch script to delete itself.

jRAT has command line access.

Helminth can provide a remote shell. One version of Helminth uses batch scripting.

BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.

Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.

Comnie executes BAT scripts.