Windows Command Shell

T1059.003

Sub-technique of T1059 Command and Scripting Interpreter.View on attack.mitre.org

About this technique

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.

Detection rules48

Rules on DetectionCode tagged with T1059.003.

Sigma28

Rule	Level	Log source
AWS EC2 Startup Shell Script Change	high	aws / NULL
Conhost.exe CommandLine Path Traversal	high	windows / process_creation
DNS Query by Finger Utility	high	windows / dns_query
HackTool - CrackMapExec Execution	high	windows / process_creation
HackTool - CrackMapExec Execution Patterns	high	windows / process_creation
HackTool - Koadic Execution	high	windows / process_creation
HackTool - RedMimicry Winnti Playbook Execution	high	windows / process_creation
HTML Help HH.EXE Suspicious Child Process	high	windows / process_creation
Network Connection Initiated via Finger.EXE	high	windows / network_connection
Operator Bloopers Cobalt Strike Commands	high	windows / process_creation
Operator Bloopers Cobalt Strike Modules	high	windows / process_creation
Potential CommandLine Path Traversal Via Cmd.EXE	high	windows / process_creation
Suspicious HH.EXE Execution	high	windows / process_creation
Suspicious HWP Sub Processes	high	windows / process_creation
AppLocker Application Would Have Been Blocked	medium	windows / NULL
AppLocker Prevented Application or Script from Running	medium	windows / NULL
Command Line Execution with Suspicious URL and AppData Strings	medium	windows / process_creation
HackTool - Jlaive In-Memory Assembly Execution	medium	windows / process_creation
OpenEDR Spawning Command Shell	medium	windows / process_creation
Powershell Execute Batch Script	medium	windows / ps_script
Powershell Executed From Headless ConHost Process	medium	windows / process_creation
PUA - AdvancedRun Execution	medium	windows / process_creation
Read Contents From Stdin Via Cmd.EXE	medium	windows / process_creation
Suspicious Usage of For Loop with Recursive Directory Search in CMD	medium	windows / process_creation
Remote Access Tool - ScreenConnect Command Execution	low	windows / NULL
Remote Access Tool - ScreenConnect File Transfer	low	windows / NULL
Remote Access Tool - ScreenConnect Remote Command Execution	low	windows / process_creation
Remote Access Tool - ScreenConnect Temporary File	low	windows / file_event

Splunk20

Rule	Type	Risk	Data source
CMD Carry Out String Command Parameter	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
CMD Echo Pipe - Escalation	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
CrushFTP Authentication Bypass Exploitation	TTP	NULL	CrushFTP
Detect Prohibited Applications Spawning cmd exe	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect Use of cmd exe to Launch Script Interpreters	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
First time seen command line argument	Hunting	NULL	Sysmon EventID 1
Potentially malicious code on commandline	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Ryuk Wake on LAN Command	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Command Shell DCRat ForkBomb Payload	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows connhost exe started forcefully	TTP	NULL	Sysmon EventID 1
Windows Content Copied from Browser was Executed	TTP	NULL	Sysmon EventID 13 AND Sysmon EventID 24
Windows File Association Modification via Ftype	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows For Loop Usage Within Cmd.exe To Execute Commands	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows PowerShell FakeCAPTCHA Clipboard Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data
Windows Powershell History File Deletion	Anomaly	NULL	Powershell Script Block Logging 4104
Windows PowerShell Invoke-Sqlcmd Execution	Hunting	NULL	Powershell Script Block Logging 4104
Windows Shell Process from CrushFTP	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows SQLCMD Execution	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Suspicious React or Next.js Child Process	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows TinyCC Shellcode Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688

Software295

4H RAT ABK Action RAT adbupd ADVSTORESHELL Akira Anchor Astaroth AsyncRAT AuditCred AuTo Stealer Babuk BabyShark BackConfig BACKSPACE BADHATCH BADNEWS Bandook Bankshot Bazar BBK BISCUIT Bisonal Black Basta

Show 271 more

BlackCat BLACKCOFFEE BlackMould BLINDINGCAN BONDUPDATER BoxCaon Brute Ratel C4 Bumblebee CALENDAR Carbanak Cardinal RAT CARROTBAT Caterpillar WebShell ccf32 Chaes CharmPower China Chopper Clambling Clop cmd Cobalt Strike Cobian RAT CoinTicker Comnie ComRAT Conti Covenant CozyCar Crimson Cuba DanBot DarkComet DarkGate DarkTortilla DarkWatchman Daserf DEADEYE DealersChoice Denis Dipsind Diskpart DnsSystem DownPaper DropBook Dtrack DUSTTRAP ECCENTRICBANDWAGON Egregor Embargo Emissary Emotet Empire EnvyScout EvilBunny Exaramel for Windows Felismus FELIXROOT Flagpro FlawedAmmyy FunnyDream Gelsemium Gold Dragon GoldenSpy GoldMax Goopy GravityRAT GreyEnergy GrimAgent H1N1 Hannotog HARDRAIN Havoc HAWKBALL hcdLoader HeartCrypt Helminth HermeticWiper HermeticWizard Hi-Zor HiddenWasp Hikit HOMEFRY HOPLIGHT HotCroissant HTTPBrowser httpclient HTTPTroy InnaputRAT InvisiMole IPsec Helper IronWind Ixeshe JCry JHUHUGIT JPIN jRAT Kapeka Kasidet Kazuar Kevin KeyBoy KEYMARBLE KGH_SPY Koadic KOCTOPUS KOMPROGO KONNI LAMEHUG Latrodectus LightNeuron Linfo Lizar LockBit 2.0 Lokibot LookBack LoudMiner Lucifer LunarWeb Mafalda MagicRAT Manjusaka MarkiRAT Maze MCMD MechaFlounder Medusa Ransomware MegaCortex Megazord Metamorfo Meteor Micropsia Milan MirageFox Mis-Type Misdat Mivast MoleNet MoonWind More_eggs Mosquito MuddyViper MultiLayer Wiper MURKYTOP NanoCore NavRAT Nebulae NETEAGLE Netwalker NETWIRE Nightdoor njRAT OceanSalt ODAgent OilBooster Okrum OopsIE Orz Out1 OutSteel PcShare Peppy PHOREAL Pikabot PingPull Pisloader PLAINTEE PLEAD PlugX PoetRAT PoisonIvy Pony PowerDuke POWRUNER Proxysvc Pteranodon PUBLOAD PyDCrypt QakBot Qilin QUADAGENT QuasarRAT Ragnar Locker RainyDay RansomHub Raspberry Robin RATANKBA RCSession RDAT RedLeaves RedLine Stealer Remcos Remexi Revenge RAT REvil RGDoor Rising Sun ROADSWEEP RobbinHood RogueRobin RTM RunningRAT Ryuk S-Type Saint Bot Sakula SampleCheck5000 SamSam Samurai Sardonic SDBbot SeaDuke Seasalt SEASHARPEE ServHelper Seth-Locker Shark SharpDisco SharpStage ShimRat SideTwist SILENTTRINITY Siloscape SLOTHFULMEDIA Small Sieve SNUGRIDE Spark SQLRat Squirrelwaffle STARWHALE StreamEx StrelaStealer StrifeWater SUGARUSH SYSCON SystemBC Taidoor TAINTEDSCRIBE TAMECAT Tarrask TDTESS TEXTMATE TinyTurla TinyZBot TONESHELL TrickBot Trojan.Karagany Troll Stealer TSCookie Turian TURNEDUP TYPEFRAME UBoatRAT Umbreon UPPERCUT Uroburos USBferry Volgmer WarzoneRAT WastedLocker WEBC2 WellMess WhisperGate Wiarp Woody RAT xCaon XTunnel Zebrocy Zeus Panda ZLib zwShell ZxShell

Campaigns18

2016 Ukraine Electric Power Attack 2025 Poland Wiper Attacks APT28 Nearest Neighbor Campaign C0015 C0017 Frankenstein FunnyDream HomeLand Justice Night Dragon Operation AkaiRyū Operation CuckooBees Operation Digital Eye Operation Dream Job Operation Honeybee Operation Wocao SharePoint ToolShell Exploitation SolarWinds Compromise Water Curupira Pikabot Distribution

Procedure examples386

Groups73

Used by	Procedure example
Groupadmin@338	Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer. FireEye admin@338
GroupAgrius	Agrius uses ASPXSpy web shells to enable follow-on command execution via `cmd.exe`. SentinelOne Agrius 2021
GroupAPT1	APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution. Mandiant APT1
GroupAPT18	APT18 uses cmd.exe to execute commands on the victim’s machine. Anomali Evasive Maneuvers July 2015 PaloAlto DNS Requests May 2016
GroupAPT28	An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads. Accenture SNAKEMACKEREL Nov 2018 Talos Seduploader Oct 2017 TrendMicro Pawn Storm Dec 2020 Unit 42 Playbook Dec 2017 Unit42 Cannon Nov 2018
GroupAPT3	An APT3 downloader uses the Windows command `"cmd.exe" /C whoami`. The group also uses a tool to execute commands on remote computers. FireEye Operation Double Tap Symantec Buckeye
GroupAPT32	APT32 has used cmd.exe for execution. Cybereason Cobalt Kitty 2017
GroupAPT37	APT37 has used the command-line interface. FireEye APT37 Feb 2018 Talos Group123

View all 73 groups examples

Software295

Used by	Procedure example
Malware4H RAT	4H RAT has the capability to create a remote shell. CrowdStrike Putter Panda
MalwareABK	ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host. Trend Micro Tick November 2019
MalwareAction RAT	Action RAT can use `cmd.exe` to execute commands on an infected host. MalwareBytes SideCopy Dec 2021
Malwareadbupd	adbupd can run a copy of cmd.exe. Microsoft PLATINUM April 2016
MalwareADVSTORESHELL	ADVSTORESHELL can create a remote shell and run a given command. Bitdefender APT28 Dec 2015 ESET Sednit Part 2
MalwareAkira	Akira executes from the Windows command line and can take various arguments for execution. Kersten Akira 2023
MalwareAnchor	Anchor has used cmd.exe to run its self deletion routine. Cyberreason Anchor December 2019
MalwareAstaroth	Astaroth spawns a CMD process to execute commands. Cybereason Astaroth Feb 2019

View all 295 software examples

Campaigns18

Used by	Procedure example
Campaign2016 Ukraine Electric Power Attack	During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `xp_cmdshell` command in MS-SQL. Dragos Crashoverride 2018
Campaign2025 Poland Wiper Attacks	During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run `cmd.exe` commands on multiple victim machines. CERT Polska
CampaignAPT28 Nearest Neighbor Campaign	During APT28 Nearest Neighbor Campaign, APT28 used `cmd.exe` for execution. Nearest Neighbor Volexity
CampaignC0015	During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries. DFIR Conti Bazar Nov 2021
CampaignC0017	During C0017, APT41 used `cmd.exe` to execute reconnaissance commands. Mandiant APT41
CampaignFrankenstein	During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line Talos Frankenstein June 2019
CampaignFunnyDream	During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script. Bitdefender FunnyDream Campaign November 2020
CampaignHomeLand Justice	During HomeLand Justice, threat actors used Windows batch files for persistence and execution. CISA Iran Albanian Attacks September 2022 Microsoft Albanian Government Attacks September 2022

View all 18 campaigns examples

References1

SSH in Windows Open source
Microsoft. (2020, May 19). Tutorial: SSH in Windows Terminal. Retrieved July 26, 2021.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.