Command and Scripting Interpreter: Windows Command Shell

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL.^[2]

4H RAT has the capability to create a remote shell.^[3]

ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.^[4]

Action RAT can use cmd.exe to execute commands on an infected host.^[5]

adbupd can run a copy of cmd.exe.^[6]

Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.^[7]

ADVSTORESHELL can create a remote shell and run a given command.^[8][9]

Akira executes from the Windows command line and can take various arguments for execution.^[10]

Anchor has used cmd.exe to run its self deletion routine.^[11]

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.^[12]

APT18 uses cmd.exe to execute commands on the victim’s machine.^[13][14]

An APT28 loader Trojan uses a cmd.exe and batch script to run its payload.^[15] The group has also used macros to execute payloads.^{[16][17][18][19]}

An APT3 downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.^[20][21]

APT32 has used cmd.exe for execution.^[22]

APT37 has used the command-line interface.^[23][24]

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.^[25]

APT41 used cmd.exe /c to execute commands on remote machines.^[26]APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.^[27]

APT5 has used cmd.exe for execution on compromised systems.^[28]

Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to cmd /C.^[29]

Astaroth spawns a CMD process to execute commands. ^[30]

AuditCred can open a reverse shell on the system to execute commands.^[31]

AuTo Stealer can use cmd.exe to execute a created batch file.^[5]

Babuk has the ability to use the command line to control execution on compromised hosts.^[32][33]

BabyShark has used cmd.exe to execute commands.^[34]

BackConfig can download and run batch files to execute commands on a compromised host.^[35]

Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.^[36]

BADHATCH can use cmd.exe to execute commands on a compromised host.^[37][38]

BADNEWS is capable of executing commands via cmd.exe.^[39][40]

Bandook is capable of spawning a Windows command shell.^[41][42]

Bankshot uses the command-line interface to execute arbitrary commands.^[43][44]

Bazar can launch cmd.exe to perform reconnaissance commands.^[45][46]

BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.^[4]

BISCUIT has a command to launch a command shell on the system.^[47]

Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.^[48][49][50]

Black Basta can use cmd.exe to enable shadow copy deletion.^[51]

BlackCat can execute commands on a compromised network with the use of cmd.exe.^[52]

BLACKCOFFEE has the capability to create a reverse shell.^[53]

BlackMould can run cmd.exe with parameters.^[54]

BLINDINGCAN has executed commands via cmd.exe.^[55]

Blue Mockingbird has used batch script files to automate execution and deployment of payloads.^[56]

BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.^[57]

BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.^[58]

BRONZE BUTLER has used batch scripts and the command-line interface for execution.^[59]

Brute Ratel C4 can use cmd.exe for execution.^[60]

Bumblebee can use cmd.exe to drop and run files.^[61][62]

During C0015, the threat actors used cmd.exe to execute commands and run malicious binaries.^[63]

During C0017, APT41 used cmd.exe to execute reconnaissance commands.^[64]

CALENDAR has a command to run cmd.exe to execute commands.^[47]

Carbanak has a command to create a reverse shell.^[65]

Cardinal RAT can execute commands.^[66]

CARROTBAT has the ability to execute command line arguments on a compromised host.^[67]

Caterpillar WebShell can run commands on the compromised asset with CMD functions.^[68]

ccf32 has used cmd.exe for archiving data and deleting files.^[69]

Chaes has used cmd to execute tasks on the system.^[70]

The C# implementation of the CharmPower command execution module can use cmd.^[71]

Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.^[72]

China Chopper's server component is capable of opening a command terminal.^[73][74][75]

Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO.^[76]

Clambling can use cmd.exe for command execution.^[77]

Clop can use cmd.exe to help execute commands on the system.^[78]

cmd is used to execute programs and other actions at the command-line interface.^[79]

Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.^[80] The group has used an exploit toolkit known as Threadkit that launches .bat files.^{[81][82][83][80][84][85]}

Cobalt Strike uses a command-line interface to interact with systems.^{[86][87][88][89]}

Cobian RAT can launch a remote command shell interface for executing commands.^[90]

CoinTicker executes a bash script to establish a reverse shell.^[91]

Comnie executes BAT scripts.^[92]

ComRAT has used cmd.exe to execute commands.^[93]

Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.^[94][63]

A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.^[95]

Crimson has the ability to execute commands with the COMSPEC environment variable.^[96]

Cuba has used cmd.exe /c and batch files for execution.^[97]

DanBot has the ability to execute arbitrary commands via cmd.exe.^[98][99]

Dark Caracal has used macros in Word documents that would download a second stage if executed.^[100]

DarkComet can launch a remote shell to execute commands on the victim’s machine.^[101]

DarkGate uses a malicious Windows Batch script to run the Windows code utility to retrieve follow-on script payloads.^[102]

Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.^[103]

DarkTortilla can use cmd.exe to add registry keys for persistence.^[104]

DarkWatchman can use cmd.exe to execute commands.^[105]

Daserf can execute shell commands.^[106][59]

DEADEYE can run cmd /c copy /y /b C:\Users\public\syslog_6-*.dat C:\Users\public\syslog.dll to combine separated sections of code into a single DLL prior to execution.^[64]

DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.^[107]

Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.^[108][22]

Dipsind can spawn remote shells.^[6]

DnsSystem can use cmd.exe for execution.^[109]

DownPaper uses the command line.^[110]

Dragonfly has used various types of scripting to perform operations, including batch scripts.^[111]

DropBook can execute arbitrary shell commands on the victims' machines.^[112][113]

Dtrack has used cmd.exe to add a persistent service.^[114]

ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.^[115]

Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.^[116][117]

Ember Bear had used cmd.exe and Windows Script Host (wscript) to execute malicious code.^[118]

Emissary has the capability to create a remote shell and execute specified commands.^[119]

Emotet has used cmd.exe to run a PowerShell script. ^[120]

Empire has modules for executing scripts.^[121]

EnvyScout can use cmd.exe to execute malicious files on compromised hosts.^[122]

EvilBunny has an integrated scripting engine to download and execute Lua scripts.^[123]

Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.^[124]

Felismus uses command line for execution.^[125]

FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.^[126][127]

FIN10 has executed malicious .bat files containing PowerShell commands.^[128]

FIN13 has leveraged xp_cmdshell and Windows Command Shell to execute commands on a compromised machine. FIN13 has also attempted to leverage the ‘xp_cmdshell’ SQL procedure to execute remote commands on internal MS-SQL servers.^[129][130]

FIN6 has used kill.bat script to disable security tools.^[131]

FIN7 used the command prompt to launch commands on the victim’s machine.^{[132][133][134]}

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.^[135] FIN8 has also executed commands remotely via cmd.exe.^{[136][137][138]}

Flagpro can use cmd.exe to execute commands received from C2.^[139]

FlawedAmmyy has used cmd to execute commands on a compromised host.^[140]

Fox Kitten has used cmd.exe likely as a password changing mechanism.^[141]

During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line ^[142]

FunnyDream can use cmd.exe for execution on remote hosts.^[69]

During FunnyDream, the threat actors used cmd.exe to execute the wmiexec.vbs script.^[69]

GALLIUM used the Windows command shell to execute commands.^[143]

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.^{[144][145][146][147]}

Gelsemium can use a batch script to delete itself.^[148]

Gold Dragon uses cmd.exe to execute commands for discovery.^[149]

GoldenSpy can execute remote commands via the command-line interface.^[150]

GoldMax can spawn a command shell, and execute native commands.^[151][152]

Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.^[22]

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.^[153]

GravityRAT executes commands remotely on the infected host.^[154]

GreyEnergy uses cmd.exe to execute itself in-memory.^[127]

GrimAgent can use the Windows Command Shell to execute commands, including its own removal.^[155]

H1N1 kills and disables services by using cmd.exe.^[156]

HAFNIUM has used cmd.exe to execute commands on the victim's machine.^[157]

HARDRAIN uses cmd.exe to execute netshcommands.^[158]

HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.^[159]

hcdLoader provides command-line access to the compromised system.^[160]

Helminth can provide a remote shell. One version of Helminth uses batch scripting.^[161]

HermeticWiper can use cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1 to deploy on an infected system.^[162]

HermeticWizard can use cmd.exe for execution on compromised hosts.^[162]

Hi-Zor has the ability to create a reverse shell.^[163]

HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.^[164]

Higaisa used cmd.exe for execution.^{[165][166][167]}

Hikit has the ability to create a remote shell and run given commands.^[168]

HOMEFRY uses a command-line interface.^[169]

HOPLIGHT can launch cmd.exe to execute commands on the system.^[170]

HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.^[171]

HTTPBrowser is capable of spawning a reverse shell on a victim.^[172]

httpclient opens cmd.exe on the victim.^[3]

Indrik Spider has used batch scripts on victim's machines.^[173]

InnaputRAT launches a shell to execute commands on the victim’s machine.^[174]

InvisiMole can launch a remote shell to execute commands.^[175][176]

Ixeshe is capable of executing commands via cmd.^[177]

JCry has used cmd.exe to launch PowerShell.^[178]

JHUHUGIT uses a .bat file to execute a .dll.^[16]

JPIN can use the command-line utility cacls.exe to change file permissions.^[6]

jRAT has command line access.^[179]

Kasidet can execute commands using cmd.exe.^[180]

Kazuar uses cmd.exe to execute commands on the victim’s machine.^[181]

Ke3chang has used batch scripts in its malware to install persistence mechanisms.^[182]

Kevin can use a renamed image of cmd.exe for execution.^[183]

KeyBoy can launch interactive shells for communicating with the victim machine.^[184][185]

KEYMARBLE can execute shell commands using cmd.exe.^[186]

KGH_SPY has the ability to set a Registry key to run a cmd.exe command.^[187]

Kimsuky has executed Windows commands by using cmd and running batch scripts.^[188][189]

Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.^[190][191]

KOCTOPUS has used cmd.exe and batch files for execution.^[191]

KOMPROGO is capable of creating a reverse shell.^[192]

KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.^{[193][194][195]}

Lazarus Group malware uses cmd.exe to execute commands on a compromised host.^{[196][197][198][199][200]} A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.^[201]

LazyScripter has used batch files to deploy open-source and multi-stage RATs.^[191]

LightNeuron is capable of executing commands via cmd.exe.^[202]

Linfo creates a backdoor through which remote attackers can start a remote shell.^[203]

Lizar has a command to open the command-line on the infected system.^[204][205]

Lokibot has used cmd /c commands embedded within batch scripts.^[206]

LookBack executes the cmd.exe command.^[207]

LoudMiner used a batch script to run the Linux virtual machine as a service.^[208]

Lucifer can issue shell commands to download and execute additional payloads.^[209]

Machete has used batch files to initiate additional downloads of malicious files.^[210]

Mafalda can execute shell commands using cmd.exe.^[211]

Magic Hound has used the command-line interface for code execution.^{[212][213][214]}

MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.^[215]

The Maze encryption process has used batch scripts with various commands.^[216][217]

MCMD can launch a console process (cmd.exe) with redirected standard input and output.^[218]

MechaFlounder has the ability to run commands on a compromised host.^[219]

MegaCortex has used .cmd scripts on the victim's system.^[220]

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.^{[221][222][223][224]} menuPass has used malicious macros embedded inside Office documents to execute files.^[225][224]

Metador has used the Windows command line to execute commands.^[226]

Metamorfo has used cmd.exe /c to execute files.^[227]

Meteor can run set.bat, update.bat, cache.bat, bcd.bat, msrun.bat, and similar scripts.^[228]

Micropsia creates a command-line shell using cmd.exe.^[229]

Milan can use cmd.exe for discovery actions on a targeted system.^[99]

MirageFox has the capability to execute commands using cmd.exe.^[230]

Mis-Type has used cmd.exe to run commands on a compromised host.^[231]

Misdat is capable of providing shell functionality to the attacker to execute commands.^[231]

Mivast has the capability to open a remote shell and run basic commands.^[232]

MoleNet can execute commands via the command line utility.^[112]

MoonWind can execute commands via an interactive command shell.^[233] MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.^[233]

More_eggs has used cmd.exe for execution.^[234][235]

Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.^[236]

MuddyWater has used a custom tool for creating reverse shells.^[237]

MURKYTOP uses the command-line interface.^[169]

Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.^[238][239]

NanoCore can open a remote command-line interface and execute commands.^[240] NanoCore uses JavaScript files.^[241]

NavRAT leverages cmd.exe to perform discovery techniques.^[242] NavRAT loads malicious shellcode and executes it in memory.^[242]

Nebulae can use CMD to execute a process.^[243]

NETEAGLE allows adversaries to execute shell commands on the infected host.^[36]

Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.^[244]

NETWIRE can issue commands using cmd.exe.^[245][246]

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.^[247]

njRAT can launch a command shell interface for executing commands.^[248]

Nomadic Octopus used cmd.exe /c within a malicious macro.^[249]

OceanSalt can create a reverse shell on the infected endpoint using cmd.exe.^[250] OceanSalt has been executed via malicious macros.^[250]

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE.^{[251][252][253][254][255]} OilRig has used batch scripts.^{[251][252][253][254][255]}

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.^[256]

OopsIE uses the command prompt to execute commands on the victim's machine.^[253][257]

During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.^[258]

During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.^[259][260]

During Operation Honeybee, various implants used batch scripting and cmd.exe for execution.^[261]

During Operation Wocao, threat actors spawned a new cmd.exe process to execute commands.^[262]

Orz can execute shell commands.^[263] Orz can execute commands with JavaScript.^[263]

Out1 can use native command line for execution.^[264]

OutSteel has used cmd.exe to scan a compromised host for specific file extensions.^[118]

Patchwork ran a reverse shell with Meterpreter.^[265] Patchwork used JavaScript code and .SCT files on victim machines.^[40][266]

PcShare can execute cmd commands on a compromised host.^[69]

Peppy has the ability to execute shell commands.^[267]

PHOREAL is capable of creating reverse shell.^[192]

PingPull can use cmd.exe to run various commands as a reverse shell.^[268]

Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.^[269]

PLAINTEE uses cmd.exe to execute commands on the victim’s machine.^[270]

PLEAD has the ability to execute shell commands on the compromised host.^[271]

PlugX allows actors to spawn a reverse shell on a victim.^[172][272]

PoetRAT has called cmd through a Word document macro.^[273]

PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.^[274]

Pony has used batch scripts to delete itself after execution.^[275]

PowerDuke runs cmd.exe /c and sends the output to its C2.^[276]

POWRUNER can execute commands from its C2 server.^[251]

Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c " > %temp%\PM* .tmp 2>&1".^[201]

Pteranodon can use cmd.exe for execution on victim systems.^[144][277]

PyDCrypt has used cmd.exe for execution.^[278]

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.^{[279][280][281][89]}

QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.^[254]

QuasarRAT can launch a remote shell to execute commands on the victim’s machine.^[282][283]

Ragnar Locker has used cmd.exe and batch scripts to execute commands.^[284]

RainyDay can use the Windows Command Shell for execution.^[243]

Rancor has used cmd.exe to execute commmands.^[270]

RATANKBA uses cmd.exe to execute commands.^[285][286]

RCSession can use cmd.exe for execution on compromised hosts.^[77]

RDAT has executed commands using cmd.exe /c.^[287]

RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.^[222][288]

Remcos can launch a remote command line to execute commands on the victim’s machine.^[289]

Remexi silently executes received commands with cmd.exe.^[290]

Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.^[291]

REvil can use the Windows command line to delete volume shadow copies and disable recovery.^{[292][293][294][295]}

RGDoor uses cmd.exe to execute commands on the victim’s machine.^[296]

Rising Sun has executed commands using cmd.exe /c "<command> > <%temp%>\AM<random>. tmp" 2>&1.^[297]

RobbinHood uses cmd.exe on the victim's computer.^[298]

RogueRobin uses Windows Script Components.^[299][300]

RTM uses the command line and rundll32.exe to execute.^[301]

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.^[149]

Ryuk has used cmd.exe to create a Registry entry to establish persistence.^[302]

S-Type has provided the ability to execute shell commands on a compromised host.^[231]

Saint Bot has used cmd.exe and .bat scripts for execution.^[118]

Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.^[303]

SamSam uses custom batch scripts to execute some of its components.^[304]

Samurai can use a remote command module for execution via the Windows command line.^[305]

Sardonic has the ability to run cmd.exe or other interactive processes on a compromised computer.^[138]

SDBbot has the ability to use the command shell to execute commands on a compromised host.^[306]

SeaDuke is capable of executing commands.^[307]

Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.^[47]

SEASHARPEE can execute commands on victims.^[308]

ServHelper can execute shell commands against cmd.^[309][310]

Seth-Locker can execute commands via the command line shell.^[311]

Shark has the ability to use CMD to execute commands.^[99][312]

SharpDisco can use cmd.exe to execute plugins and to send command output to specified SMB shares.^[313]

SharpStage can execute arbitrary commands with the command line.^[112][113]

ShimRat can be issued a command shell function from the C2.^[314]

SideTwist can execute shell commands on a compromised host.^[315]

Silence has used Windows command-line to run commands.^{[316][317][318]}

SILENTTRINITY can use cmd.exe to enable lateral movement using DCOM.^[319]

Siloscape can run cmd through an IRC channel.^[320]

SLOTHFULMEDIA can open a command line to execute commands.^[321]

Small Sieve can use cmd.exe to execute commands on a victim's system.^[322]

SNUGRIDE is capable of executing commands and spawning a reverse shell.^[288]

During the SolarWinds Compromise, APT29 used cmd.exe to execute commands on remote machines.^[323][324]

Sowbug has used command line during its intrusions.^[325]

Spark can use cmd.exe to run commands.^[326]

SQLRat has used SQL to execute JavaScript and VB scripts on the host system.^[133]

Squirrelwaffle has used cmd.exe for execution.^[327]

STARWHALE has the ability to execute commands via cmd.exe.^[328]

StreamEx has the ability to remotely execute commands.^[329]

StrifeWater can execute shell commands using cmd.exe.^[330]

Several tools used by Suckfly have been command-line driven.^[331]

SUGARUSH has used cmd for execution on an infected host.^[332]

SYSCON has the ability to execute commands through cmd on a compromised host.^[67]

TA505 has executed commands using cmd.exe.^[333]

TA551 has used cmd.exe to execute commands.^[334]

Taidoor can copy cmd.exe into the system temp folder.^[335]

TAINTEDSCRIBE can enable Windows CLI access and execute files.^[336]

Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.^[337]

TDTESS provides a reverse shell on the victim.^[338]

TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.^[339]

TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.^[340][341]

Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.^[342]

Threat Group-3390 has used command-line interfaces for execution.^[73][343]

TinyTurla has been installed using a .bat file.^[344]

TinyZBot supports execution from the command-line.^[345]

ToddyCat has used .bat scripts and cmd for execution on compromised hosts.^[346]

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.^[347]

Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.^[348]

Tropic Trooper has used Windows command scripts.^[349]

TSCookie has the ability to execute shell commands on the infected host.^[350]

Turian can create a remote shell and execute commands using cmd.^[351]

Turla RPC backdoors have used cmd.exe to execute commands.^[352][353]

TURNEDUP is capable of creating a reverse shell.^[354]

TYPEFRAME can uninstall malware components using a batch script.^[355] TYPEFRAME can execute commands using a shell.^[355]

UBoatRAT can start a command shell.^[356]

Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet^[357]

UPPERCUT uses cmd.exe to execute commands on the victim’s machine.^[224]

Uroburos has the ability to use the command line for execution on the targeted system.^[358]

USBferry can execute various Windows commands.^[349]

Volgmer can execute commands on the victim's machine.^[359][360]

Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.^{[361][362][363]}

WarzoneRAT can use cmd.exe to execute malicious code.^[364]

WastedLocker has used cmd to execute commands on the system.^[365]

WEBC2 can open an interactive command shell.^[12]

WellMess can execute command line scripts received from C2.^[366]

WhisperGate can use cmd.exe to execute commands.^[367]

Wiarp creates a backdoor through which remote attackers can open a command line interface.^[368]

Wizard Spider has used cmd.exe to execute commands on a victim's machine.^[369][370]

Woody RAT can execute commands using cmd.exe.^[371]

xCaon has a command to start an interactive shell.^[58]

XTunnel has been used to execute remote commands.^[372]

Zebrocy uses cmd.exe to execute commands on the system.^[373][374]

Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.^[375]

ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.^[376]

ZLib has the ability to execute shell commands.^[231]

zwShell can launch command-line shells.^[247]

ZxShell can launch a reverse command shell.^{[26][377][378]}

Use application control where appropriate.