Procedure examples

PHOREAL is capable of creating reverse shell.

Lizar has a command to open the command-line on the infected system.

Dtrack has used cmd.exe to add a persistent service.

H1N1 kills and disables services by using cmd.exe.

Seth-Locker can execute commands via the command line shell.

LoudMiner used a batch script to run the Linux virtual machine as a service.

Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.

UPPERCUT uses cmd.exe to execute commands on the victim’s machine.

ADVSTORESHELL can create a remote shell and run a given command.

StrifeWater can execute shell commands using `cmd.exe`.

Mivast has the capability to open a remote shell and run basic commands.

HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.

WarzoneRAT can use `cmd.exe` to execute malicious code.

SLOTHFULMEDIA can open a command line to execute commands.

Small Sieve can use `cmd.exe` to execute commands on a victim's system.

HermeticWizard can use `cmd.exe` for execution on compromised hosts.

Covenant provides access to a Command Shell in Windows environments for follow-on command execution and tasking.

Diskpart can execute a disk partition script file, which attempts to mount a virtual hard disk. Diskpart can also assign and mount virtual disks.

SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.

Empire has modules for executing scripts.

PcShare can execute `cmd` commands on a compromised host.

AsyncRAT can be deployed via batch script.

Brute Ratel C4 can use cmd.exe for execution.

Remcos can launch a remote command line to execute commands on the victim’s machine.

Out1 can use native command line for execution.

MCMD can launch a console process (cmd.exe) with redirected standard input and output.

cmd is used to execute programs and other actions at the command-line interface.

Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.

QuasarRAT can launch a remote shell to execute commands on the victim’s machine.

BRICKSTORM has executed shell commands using `/bin/sh`.

COATHANGER provides a BusyBox reverse shell for command and control.

WindTail can use the open command to execute an application.

Exaramel for Linux has a command to execute a shell command on the system.

CASTLETAP has the ability to spawn BusyBox command shell in victim environments.

NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.

The J-magic agent is executed through a command line argument which specifies an interface and listening port.

Gomir reads command line arguments and parses them for functionality when executed from a Linux shell, and can execute arbitrary strings passed to it as shell commands.

BOLDMOVE is capable of spawning a remote command shell.

Turian has the ability to use /bin/sh to execute commands.

Hildegard has used shell scripts for execution.

Cuckoo Stealer can spawn a bash shell to enable execution on compromised hosts.

Skidmap has used pm.sh to download and install its main payload.

REPTILE can deploy components automatically with shell scripts.

Doki has executed shell scripts with /bin/sh.

Fysbis has the ability to create and execute commands in a remote shell for CLI.

Kazuar uses /bin/bash to execute commands on the victim’s machine.

Green Lambert can use shell scripts for execution, such as /bin/sh -c.

SnappyTCP creates the reverse shell using a pthread spawning a bash shell.

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.

Anchor can execute payloads via shell scripting.