Procedure examples

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.

PowerDuke runs cmd.exe /c and sends the output to its C2.

BLINDINGCAN has executed commands via cmd.exe.

Pikabot can execute Windows shell commands via cmd.exe.

Wiarp creates a backdoor through which remote attackers can open a command line interface.

RCSession can use `cmd.exe` for execution on compromised hosts.

Spark can use cmd.exe to run commands.

Bumblebee can use `cmd.exe` to drop and run files.

MURKYTOP uses the command-line interface.

Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.

Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c "<file_path> > %temp%\PM* .tmp 2>&1".

Orz can execute shell commands. Orz can execute commands with JavaScript.

IronWind has used the Windows command shell to execute malicious files.

SEASHARPEE can execute commands on victims.

POWRUNER can execute commands from its C2 server.

RobbinHood uses cmd.exe on the victim's computer.

TDTESS provides a reverse shell on the victim.

SharpStage can execute arbitrary commands with the command line.

Sardonic has the ability to run `cmd.exe` or other interactive processes on a compromised computer.

Misdat is capable of providing shell functionality to the attacker to execute commands.

adbupd can run a copy of cmd.exe.

Emissary has the capability to create a remote shell and execute specified commands.

KEYMARBLE can execute shell commands using cmd.exe.

HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.

TAMECAT has used `cmd.exe` to run the `curl` command.

HeartCrypt can use the `reg add` command via `cmd.exe` for Registry modification.

RansomHub can use `cmd.exe` to execute multiple commands on infected hosts.

ZLib has the ability to execute shell commands.

RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.

Felismus uses command line for execution.

Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.

Havoc can execute commands via `cmd.exe`.

CARROTBAT has the ability to execute command line arguments on a compromised host.

GravityRAT executes commands remotely on the infected host.

WEBC2 can open an interactive command shell.

Bankshot uses the command-line interface to execute arbitrary commands.

SharpDisco can use `cmd.exe` to execute plugins and to send command output to specified SMB shares.

xCaon has a command to start an interactive shell.

PLAINTEE uses cmd.exe to execute commands on the victim’s machine.

Pony has used batch scripts to delete itself after execution.

Nebulae can use CMD to execute a process.

AuditCred can open a reverse shell on the system to execute commands.

TONESHELL has created a reverse shell using `cmd.exe`.

Kasidet can execute commands using cmd.exe.

Hannotog can execute various `cmd.exe /c %s` commands.

OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros.

Medusa Ransomware has used `cmd.exe` to execute command on an infected host.

RainyDay can use the Windows Command Shell for execution.

NETWIRE can issue commands using cmd.exe.

TinyTurla has been installed using a .bat file.