Procedure examples

POWERTON is written in PowerShell.

QakBot can use PowerShell to download and execute payloads.

Hancitor has used PowerShell to execute commands.

One version of Helminth uses a PowerShell script.

Denis has a version written in PowerShell.

AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.

JSS Loader has the ability to download and execute PowerShell scripts.

Lizar has used PowerShell scripts.

WarzoneRAT can use PowerShell to download files and execute commands.

Covenant can create PowerShell-based launchers for Grunt installation.

BloodHound can use PowerShell to pull Active Directory information from the target environment.

Sliver has built-in functionality to launch a Powershell command prompt.

SILENTTRINITY can use PowerShell to execute commands.

PowerSploit modules are written in and executed via PowerShell.

AADInternals is written and executed via PowerShell.

Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module.

ConnectWise can be used to execute PowerShell commands on target machines.

Donut can generate shellcode outputs that execute via PowerShell.

CrackMapExec can execute PowerShell commands via WMI.

Koadic has used PowerShell to establish persistence.

Pupy has a module for loading and executing PowerShell scripts.

ZeroCleare can use a malicious PowerShell script to bypass Windows controls.

macOS.OSAMiner has used `osascript` to call itself via the `do shell script` command in the Launch Agent `.plist` file.

Cuckoo Stealer can use osascript to generate a password-stealing prompt, duplicate files and folders, and set environmental variables.

ThiefQuest uses AppleScript's osascript -e command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon.

Bundlore can use AppleScript to inject malicious JavaScript into a browser.

GlassWorm has utilized AppleScript to include `set keychainPassword to do shell script` to execute shell command that retrieves passwords from the macOS keychain.

Dok uses AppleScript to create a login item for persistence.

During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.

During SharePoint ToolShell Exploitation, threat actors utilized `cmd.exe` and batch scripts within the victim environment.

During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line

During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.

Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe.

During Operation Digital Eye, threat actors used `cmd.exe` as a default method of execution for a custom version of Mimikatz named bK2o.exe.

During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.

During HomeLand Justice, threat actors used Windows batch files for persistence and execution.

During the SolarWinds Compromise, APT29 used `cmd.exe` to execute commands on remote machines.

During Operation AkaiRyū, MirrorFace used `cmd.exe` to run PowerShell commands to drop additional files on the compromised host.

During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.

During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.

During APT28 Nearest Neighbor Campaign, APT28 used cmd.exe for execution.

During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run `cmd.exe` commands on multiple victim machines.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `xp_cmdshell` command in MS-SQL.

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.

During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.

During C0017, APT41 used `cmd.exe` to execute reconnaissance commands.

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine. Additionally, APT38 has used batch scripts.

Indrik Spider has used batch scripts on victim's machines.

BlackByte executed ransomware using the Windows command shell.

GALLIUM used the Windows command shell to execute commands.