Command and Scripting Interpreter: Windows Command Shell

4H RAT has the capability to create a remote shell.^[2]

ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.^[3]

adbupd can run a copy of cmd.exe.^[4]

Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.^[5]

ADVSTORESHELL can create a remote shell and run a given command.^[6][7]

Anchor has used cmd.exe to run its self deletion routine.^[8]

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.^[9]

APT18 uses cmd.exe to execute commands on the victim’s machine.^[10][11]

An APT28 loader Trojan uses a cmd.exe and batch script to run its payload.^[12] The group has also used macros to execute payloads.^{[13][14][15][16]}

APT29 used cmd.exe to execute commands on remote machines.^[17][18]

An APT3 downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.^[19][20]

APT32 has used cmd.exe for execution.^[21]

APT37 has used the command-line interface.^[22][23]

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.^[24]

APT41 used cmd.exe /c to execute commands on remote machines.^[25]APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.^[26]

Astaroth spawns a CMD process to execute commands. ^[27]

AuditCred can open a reverse shell on the system to execute commands.^[28]

Babuk has the ability to use the command line to control execution on compromised hosts.^[29][30]

BabyShark has used cmd.exe to execute commands.^[31]

BackConfig can download and run batch files to execute commands on a compromised host.^[32]

Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.^[33]

BADNEWS is capable of executing commands via cmd.exe.^[34][35]

Bandook is capable of spawning a Windows command shell.^[36][37]

Bankshot uses the command-line interface to execute arbitrary commands.^[38][39]

Bazar can launch cmd.exe to perform reconnaissance commands.^[40][41]

BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.^[3]

BISCUIT has a command to launch a command shell on the system.^[42]

Bisonal can launch cmd.exe to execute commands on the system.^[43][44]

BLACKCOFFEE has the capability to create a reverse shell.^[45]

BlackMould can run cmd.exe with parameters.^[46]

BLINDINGCAN has executed commands via cmd.exe.^[47]

Blue Mockingbird has used batch script files to automate execution and deployment of payloads.^[48]

BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.^[49]

BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.^[50]

BRONZE BUTLER has used batch scripts and the command-line interface for execution.^[51]

CALENDAR has a command to run cmd.exe to execute commands.^[42]

Carbanak has a command to create a reverse shell.^[52]

Cardinal RAT can execute commands.^[53]

CARROTBAT has the ability to execute command line arguments on a compromised host.^[54]

Caterpillar WebShell can run commands on the compromised asset with CMD functions.^[55]

Chaes has used cmd to execute tasks on the system.^[56]

Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.^[57]

China Chopper's server component is capable of opening a command terminal.^[58][59][60]

Clop can use cmd.exe to help execute commands on the system.^[61]

cmd is used to execute programs and other actions at the command-line interface.^[62]

Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.^[63] The group has used an exploit toolkit known as Threadkit that launches .bat files.^{[64][65][66][63][67][68]}

Cobalt Strike uses a command-line interface to interact with systems.^[69][70][71]

Cobian RAT can launch a remote command shell interface for executing commands.^[72]

CoinTicker executes a bash script to establish a reverse shell.^[73]

Comnie executes BAT scripts.^[74]

ComRAT has used cmd.exe to execute commands.^[75]

Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.^[76]

A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.^[77]

Crimson has the ability to execute commands with the COMSPEC environment variable.^[78]

Cuba has used cmd.exe /c and batch files for execution.^[79]

Dark Caracal has used macros in Word documents that would download a second stage if executed.^[80]

DarkComet can launch a remote shell to execute commands on the victim’s machine.^[81]

Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.^[82]

Daserf can execute shell commands.^[83][51]

DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.^[84]

Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.^[85][21]

Dipsind can spawn remote shells.^[4]

DownPaper uses the command line.^[86]

Dragonfly 2.0 used various types of scripting to perform operations, including batch scripts.^[87][88]

DropBook can execute arbitrary shell commands on the victims' machines.^[89][90]

Dtrack has used cmd.exe to add a persistent service.^[91]

ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.^[92]

Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.^[93][94]

Emissary has the capability to create a remote shell and execute specified commands.^[95]

Emotet has used cmd.exe to run a PowerShell script. ^[96]

Empire has modules for executing scripts.^[97]

EnvyScout can use cmd.exe to execute malicious files on compromised hosts.^[98]

EvilBunny has an integrated scripting engine to download and execute Lua scripts.^[99]

Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.^[100]

Felismus uses command line for execution.^[101]

FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.^[102][103]

FIN10 has executed malicious .bat files containing PowerShell commands.^[104]

FIN6 has used kill.bat script to disable security tools.^[105]

FIN7 used the command prompt to launch commands on the victim’s machine.^[106][107]

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.^[108] FIN8 has also executed commands remotely via cmd.^[109][110]

Fox Kitten has used cmd.exe likely as a password changing mechanism.^[111]

Frankenstein has run a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line.^[112]

GALLIUM used the Windows command shell to execute commands.^[113]

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.^[114][115]

Gold Dragon uses cmd.exe to execute commands for discovery.^[116]

GoldenSpy can execute remote commands via the command-line interface.^[117]

GoldMax can spawn a command shell, and execute native commands.^[118][119]

Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.^[21]

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.^[120]

GravityRAT executes commands remotely on the infected host.^[121]

GreyEnergy uses cmd.exe to execute itself in-memory.^[103]

GrimAgent can use the Windows Command Shell to execute commands, including its own removal.^[122]

H1N1 kills and disables services by using cmd.exe.^[123]

HARDRAIN uses cmd.exe to execute netshcommands.^[124]

HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.^[125]

hcdLoader provides command-line access to the compromised system.^[126]

Helminth can provide a remote shell. One version of Helminth uses batch scripting.^[127]

Hi-Zor has the ability to create a reverse shell.^[128]

HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.^[129]

Higaisa used cmd.exe for execution.^{[130][131][132]}

Hikit has the ability to create a remote shell and run given commands.^[133]

HOMEFRY uses a command-line interface.^[134]

Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.^[135] Honeybee used batch scripting.^[135]

HOPLIGHT can launch cmd.exe to execute commands on the system.^[136]

HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.^[137]

HTTPBrowser is capable of spawning a reverse shell on a victim.^[138]

httpclient opens cmd.exe on the victim.^[2]

Indrik Spider has used batch scripts on victim's machines.^[139]

InnaputRAT launches a shell to execute commands on the victim’s machine.^[140]

InvisiMole can launch a remote shell to execute commands.^[141][142]

Ixeshe is capable of executing commands via cmd.^[143]

JCry has used cmd.exe to launch PowerShell.^[144]

JHUHUGIT uses a .bat file to execute a .dll.^[13]

JPIN can use the command-line utility cacls.exe to change file permissions.^[4]

jRAT has command line access.^[145]

Kasidet can execute commands using cmd.exe.^[146]

Kazuar uses cmd.exe to execute commands on the victim’s machine.^[147]

Ke3chang has used batch scripts in its malware to install persistence mechanisms.^[148]

KeyBoy can launch interactive shells for communicating with the victim machine.^[149][150]

KEYMARBLE can execute shell commands using cmd.exe.^[151]

KGH_SPY has the ability to set a Registry key to run a cmd.exe command.^[152]

Koadic can open an interactive command-shell to perform command line functions on victim machines.^[153] Koadic performs most of its operations using Windows Script Host (Jscript) and runs arbitrary shellcode .^[153]

KOMPROGO is capable of creating a reverse shell.^[154]

KONNI has used cmd.exe execute arbitrary commands on the infected host across different stages of the infection change.^[155][156]

Lazarus Group malware uses cmd.exe to execute commands on victims.^{[157][158][159][160]} A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.^[161]

LightNeuron is capable of executing commands via cmd.exe.^[162]

Linfo creates a backdoor through which remote attackers can start a remote shell.^[163]

Lokibot has used cmd /c commands embedded within batch scripts.^[164]

LookBack executes the cmd.exe command.^[165]

LoudMiner used a batch script to run the Linux virtual machine as a service.^[166]

Lucifer can issue shell commands to download and execute additional payloads.^[167]

Machete has used batch files to initiate additional downloads of malicious files.^[168]

Magic Hound has used the command-line interface.^[169]

MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.^[170]

The Maze encryption process has used batch scripts with various commands.^[171][172]

MCMD can launch a console process (cmd.exe) with redirected standard input and output.^[173]

MechaFlounder has the ability to run commands on a compromised host.^[174]

MegaCortex has used .cmd scripts on the victim's system.^[175]

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.^{[176][177][178][179]} menuPass has used malicious macros embedded inside Office documents to execute files.^[180][179]

Metamorfo has used cmd.exe /c to execute files.^[181]

Micropsia creates a command-line shell using cmd.exe.^[182]

MirageFox has the capability to execute commands using cmd.exe.^[183]

Mis-Type uses cmd.exe to run commands for enumerating the host.^[184]

Misdat is capable of providing shell functionality to the attacker to execute commands.^[184]

Mivast has the capability to open a remote shell and run basic commands.^[185]

MoleNet can execute commands via the command line utility.^[89]

MoonWind can execute commands via an interactive command shell.^[186] MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.^[186]

More_eggs has used cmd.exe for execution.^[187][188]

Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.^[189]

MuddyWater has used a custom tool for creating reverse shells.^[190]

MURKYTOP uses the command-line interface.^[134]

Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.^[191][192]

NanoCore can open a remote command-line interface and execute commands.^[193] NanoCore uses JavaScript files.^[194]

NavRAT leverages cmd.exe to perform discovery techniques.^[195] NavRAT loads malicious shellcode and executes it in memory.^[195]

Nebulae can use CMD to execute a process.^[196]

NETEAGLE allows adversaries to execute shell commands on the infected host.^[33]

Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.^[197]

NETWIRE can issue commands using cmd.exe.^[198][199]

njRAT can launch a command shell interface for executing commands.^[200]

Nomadic Octopus used cmd.exe /c within a malicious macro.^[201]

OceanSalt can create a reverse shell on the infected endpoint using cmd.exe.^[202] OceanSalt has been executed via malicious macros.^[202]

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE.^{[203][204][205][206][207]} OilRig has used batch scripts.^{[203][204][205][206][207]}

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.^[208]

OopsIE uses the command prompt to execute commands on the victim's machine.^[205][209]

Operation Wocao has spawned a new cmd.exe process to execute commands.^[210]

Orz can execute shell commands.^[211] Orz can execute commands with JavaScript.^[211]

Out1 can use native command line for execution.^[212]

Patchwork ran a reverse shell with Meterpreter.^[213] Patchwork used JavaScript code and .SCT files on victim machines.^[35][214]

Peppy has the ability to execute shell commands.^[215]

PHOREAL is capable of creating reverse shell.^[154]

Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.^[216]

PLAINTEE uses cmd.exe to execute commands on the victim’s machine.^[217]

PLEAD has the ability to execute shell commands on the compromised host.^[218]

PlugX allows actors to spawn a reverse shell on a victim.^[138][219]

PoetRAT has called cmd through a Word document macro.^[220]

PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.^[221]

Pony has used batch scripts to delete itself after execution.^[222]

PowerDuke runs cmd.exe /c and sends the output to its C2.^[223]

POWRUNER can execute commands from its C2 server.^[203]

Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c " > %temp%\PM* .tmp 2>&1".^[161]

Pteranodon can execute commands on the victim.^[114]

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.^{[224][225][226]}

QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.^[206]

QuasarRAT can launch a remote shell to execute commands on the victim’s machine.^[227]

Ragnar Locker has used cmd.exe and batch scripts to execute commands.^[228]

RainyDay can use the Windows Command Shell for execution.^[196]

Rancor has used cmd.exe to execute commmands.^[217]

RATANKBA uses cmd.exe to execute commands.^[229][230]

RDAT has executed commands using cmd.exe /c.^[231]

RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.^[177][232]

Remcos can launch a remote command line to execute commands on the victim’s machine.^[233]

Remexi silently executes received commands with cmd.exe.^[234]

Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.^[235]

REvil can use the Windows command line to delete volume shadow copies and disable recovery.^{[236][237][238][239]}

RGDoor uses cmd.exe to execute commands on the victim’s machine.^[240]

Rising Sun executed commands using cmd.exe.^[241]

RobbinHood uses cmd.exe on the victim's computer.^[242]

RogueRobin uses Windows Script Components.^[243][244]

RTM uses the command line and rundll32.exe to execute.^[245]

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.^[116]

Ryuk has used cmd.exe to create a Registry entry to establish persistence.^[246]

Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.^[247]

SamSam uses custom batch scripts to execute some of its components.^[248]

Sandworm Team has run the xp_cmdshell command in MS-SQL.^[249]

SDBbot has the ability to use the command shell to execute commands on a compromised host.^[250]

SeaDuke is capable of executing commands.^[251]

Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.^[42]

SEASHARPEE can execute commands on victims.^[252]

ServHelper can execute shell commands against cmd.^[253][254]

Seth-Locker can execute commands via the command line shell.^[255]

SharpStage can execute arbitrary commands with the command line.^[89][90]

ShimRat can be issued a command shell function from the C2.^[256]

SideTwist can execute shell commands on a compromised host.^[257]

Silence has used Windows command-line to run commands.^{[258][259][260]}

Siloscape can run cmd through an IRC channel.^[261]

SLOTHFULMEDIA can open a command line to execute commands.^[262]

SNUGRIDE is capable of executing commands and spawning a reverse shell.^[232]

Sowbug has used command line during its intrusions.^[263]

Spark can use cmd.exe to run commands.^[264]

SQLRat has used SQL to execute JavaScript and VB scripts on the host system.^[107]

StreamEx has the ability to remotely execute commands.^[265]

Several tools used by Suckfly have been command-line driven.^[266]

SYSCON has the ability to execute commands through cmd on a compromised host.^[54]

TA505 has executed commands using cmd.exe.^[267]

TA551 has used cmd.exe to execute commands.^[268]

Taidoor can copy cmd.exe into the system temp folder.^[269]

TAINTEDSCRIBE can enable Windows CLI access and execute files.^[270]

TDTESS provides a reverse shell on the victim.^[271]

TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.^[272]

TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.^[273][274]

Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.^[275]

Threat Group-3390 has used command-line interfaces for execution.^[58][276]

TinyZBot supports execution from the command-line.^[277]

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.^[278]

Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.^[279]

Tropic Trooper has used Windows command scripts.^[280]

TSCookie has the ability to execute shell commands on the infected host.^[281]

Turian can create a remote shell and execute commands using cmd.^[282]

Turla RPC backdoors have used cmd.exe to execute commands.^[283][284]

TURNEDUP is capable of creating a reverse shell.^[285]

TYPEFRAME can uninstall malware components using a batch script.^[286] TYPEFRAME can execute commands using a shell.^[286]

UBoatRAT can start a command shell.^[287]

Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet^[288]

UPPERCUT uses cmd.exe to execute commands on the victim’s machine.^[179]

USBferry can execute various Windows commands.^[280]

Volgmer can execute commands on the victim's machine.^[289][290]

WastedLocker has used cmd to execute commands on the system.^[291]

WEBC2 can open an interactive command shell.^[9]

WellMess can execute command line scripts received from C2.^[292]

Wiarp creates a backdoor through which remote attackers can open a command line interface.^[293]

Wizard Spider has used cmd.exe to execute commands on a victim's machine.^[294]

xCaon has a command to start an interactive shell.^[50]

XTunnel has been used to execute remote commands.^[295]

Zebrocy uses cmd.exe to execute commands on the system.^[296][297]

Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.^[298]

ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.^[299]

ZLib has the ability to execute shell commands.^[184]

zwShell can launch command-line shells.^[300]

ZxShell can launch a reverse command shell.^{[25][301][302]}

Use application control where appropriate.