Procedure examples

During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.

During SharePoint ToolShell Exploitation, threat actors utilized `cmd.exe` and batch scripts within the victim environment.

During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line

During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.

Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe.

During Operation Digital Eye, threat actors used `cmd.exe` as a default method of execution for a custom version of Mimikatz named bK2o.exe.

During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.

During HomeLand Justice, threat actors used Windows batch files for persistence and execution.

During the SolarWinds Compromise, APT29 used `cmd.exe` to execute commands on remote machines.

During Operation AkaiRyū, MirrorFace used `cmd.exe` to run PowerShell commands to drop additional files on the compromised host.

During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.

During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.

During APT28 Nearest Neighbor Campaign, APT28 used cmd.exe for execution.

During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run `cmd.exe` commands on multiple victim machines.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `xp_cmdshell` command in MS-SQL.

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.

During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.

During C0017, APT41 used `cmd.exe` to execute reconnaissance commands.