Command and Scripting Interpreter: Windows Command Shell

4H RAT has the capability to create a remote shell.^[28]

ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.^[155]

adbupd can run a copy of cmd.exe.^[31]

Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.^[166]

ADVSTORESHELL can create a remote shell and run a given command.^[22][23]

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.^[53]

APT18 uses cmd.exe to execute commands on the victim’s machine.^[192][193]

An APT28 loader Trojan uses a cmd.exe and batch script to run its payload.^[189] The group has also used macros to execute payloads.^{[73][190][191]}

An APT3 downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.^[167][168]

APT32 has used cmd.exe for execution.^[137]

APT37 has used the command-line interface.^[161][162]

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.^[188]

APT39 utilized custom scripts to perform internal reconnaissance. ^[196]

APT41 used cmd.exe /c to execute commands on remote machines.^[126]APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.^[203]

Astaroth spawns a CMD process to execute commands. ^[131]

AuditCred can open a reverse shell on the system to execute commands.^[50]

BabyShark has used cmd.exe to execute commands.^[129]

BackConfig can download and run batch files to execute commands on a compromised host.^[157]

Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.^[29]

BADNEWS is capable of executing commands via cmd.exe.^[69][70]

Bandook is capable of spawning a Windows command shell.^[96]

Bankshot uses the command-line interface to execute arbitrary commands.^[51][52]

BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.^[155]

BISCUIT has a command to launch a command shell on the system.^[74]

Bisonal can launch cmd.exe to execute commands on the system.^[65]

BLACKCOFFEE has the capability to create a reverse shell.^[36]

Blue Mockingbird has used batch script files to automate execution and deployment of payloads.^[219]

BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.^[103]

BRONZE BUTLER has used batch scripts and the command-line interface for execution.^[80]

CALENDAR has a command to run cmd.exe to execute commands.^[74]

Carbanak has a command to create a reverse shell.^[90]

Cardinal RAT can execute commands.^[25]

CARROTBAT has the ability to execute command line arguments on a compromised host.^[154]

China Chopper's server component is capable of opening a command terminal.^[16][17][18]

cmd is used to execute programs and other actions at the command-line interface.^[2]

Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.^[205] The group has used an exploit toolkit known as Threadkit that launches .bat files.^{[206][207][208][205][209][210]}

Cobalt Strike uses a command-line interface to interact with systems.^[1]

Cobian RAT can launch a remote command shell interface for executing commands.^[81]

CoinTicker executes a bash script to establish a reverse shell.^[108]

Comnie executes BAT scripts.^[27]

ComRAT has used cmd.exe to execute commands.^[158]

A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.^[7]

Dark Caracal has used macros in Word documents that would download a second stage if executed.^[160]

DarkComet can launch a remote shell to execute commands on the victim’s machine.^[132]

Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.^[187]

Daserf can execute shell commands.^[79][80]

DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.^[45]

Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.^[136][137]

Dipsind can spawn remote shells.^[31]

DownPaper uses the command line.^[78]

Dragonfly 2.0 used various types of scripting to perform operations, including batch scripts.^[174][175]

Emissary has the capability to create a remote shell and execute specified commands.^[40]

Emotet has used cmd.exe to run a PowerShell script. ^[133]

Empire has modules for executing scripts.^[6]

EvilBunny has an integrated scripting engine to download and execute Lua scripts.^[123]

Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.^[138]

Felismus uses command line for execution.^[62]

FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.^[94][93]

FIN10 has executed malicious .bat files containing PowerShell commands.^[165]

FIN7 used the command prompt to launch commands on the victim’s machine.^[204][118]

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.^[172] FIN8 executes commands remotely via cmd.exe.^[173]

Frankenstein has run a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line.^[218]

Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.^[13][180]

Gold Dragon uses cmd.exe to execute commands for discovery.^[26]

Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.^[137]

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.^[164]

GravityRAT executes commands remotely on the infected host.^[12]

GreyEnergy uses cmd.exe to execute itself in-memory.^[93]

H1N1 kills and disables services by using cmd.exe.^[20]

HARDRAIN uses cmd.exe to execute netshcommands.^[15]

HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.^[119]

hcdLoader provides command-line access to the compromised system.^[61]

Helminth can provide a remote shell. One version of Helminth uses batch scripting.^[68]

Hi-Zor has the ability to create a reverse shell.^[72]

HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.^[121]

Hikit has the ability to create a remote shell and run given commands. ^[143]

HOMEFRY uses a command-line interface.^[89]

Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.^[211] Honeybee used batch scripting.^[211]

HOPLIGHT can launch cmd.exe to execute commands on the system.^[107]

HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.^[139]

HTTPBrowser is capable of spawning a reverse shell on a victim.^[66]

httpclient opens cmd.exe on the victim.^[28]

InnaputRAT launches a shell to execute commands on the victim’s machine.^[47]

InvisiMole can launch a remote shell to execute commands.^[91]

Ixeshe is capable of executing commands via cmd.^[114]

JCry has used cmd.exe to launch PowerShell.^[117]

JHUHUGIT uses a .bat file to execute a .dll.^[73]

JPIN can use the command-line utility cacls.exe to change file permissions.^[31]

jRAT has command line access.^[109]

Kasidet can execute commands using cmd.exe.^[39]

Kazuar uses cmd.exe to execute commands on the victim’s machine.^[130]

Ke3chang has used batch scripts in its malware to install persistence mechanisms.^[181]

KeyBoy can launch interactive shells for communicating with the victim machine.^[115][116]

KEYMARBLE can execute shell commands using cmd.exe.^[64]

Koadic can open an interactive command-shell to perform command line functions on victim machines.^[4] Koadic performs most of its operations using Windows Script Host (Jscript) and runs arbitrary shellcode .^[4]

KOMPROGO is capable of creating a reverse shell.^[19]

KONNI has used cmd.exe execute arbitrary commands on the infected host across different stages of the infection change.^[54][55]

Lazarus Group malware uses cmd.exe to execute commands on victims.^{[212][213][214][215]} A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.^[48]

Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell, and has used multiple types of scripting for execution, including JavaScript and JavaScript Scriptlets in XML.^[46].^[89]

LightNeuron is capable of executing commands via cmd.exe.^[122]

Linfo creates a backdoor through which remote attackers can start a remote shell.^[8]

LoudMiner used a batch script to run the Linux virtual machine as a service.^[148]

Magic Hound has used the command-line interface.^[163]

The MAZE encryption process has used batch scripts with various commands.^[147]

MechaFlounder has the ability to run commands on a compromised host.^[152]

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.^{[169][63][170][56]} menuPass has used malicious macros embedded inside Office documents to execute files.^[171][56]

Metamorfo has used cmd.exe /c to execute files.^[156]

Micropsia creates a command-line shell using cmd.exe.^[102]

MirageFox has the capability to execute commands using cmd.exe.^[100]

Mis-Type uses cmd.exe to run commands for enumerating the host.^[14]

Misdat is capable of providing shell functionality to the attacker to execute commands.^[14]

Mivast has the capability to open a remote shell and run basic commands.^[9]

MoonWind can execute commands via an interactive command shell.^[135] MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.^[135]

More_eggs has used cmd.exe for execution.^[125]

Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.^[11]

MuddyWater has used a custom tool for creating reverse shells.^[182] MuddyWater has used JavaScript files to execute its POWERSTATS payload.^{[183][184][185][182][186]}

MURKYTOP uses the command-line interface.^[89]

NanoCore can open a remote command-line interface and execute commands.^[97] NanoCore uses JavaScript files.^[98]

NavRAT leverages cmd.exe to perform discovery techniques.^[58] NavRAT loads malicious shellcode and executes it in memory.^[58]

NETEAGLE allows adversaries to execute shell commands on the infected host.^[29]

Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.^[151]

njRAT can launch a command shell interface for executing commands.^[113]

OceanSalt can create a reverse shell on the infected endpoint using cmd.exe.^[32] OceanSalt has been executed via malicious macros.^[32]

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE.^{[84][216][59][35][217]} OilRig has used batch scripts.^{[84][216][59][35][217]}

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.^[142]

OopsIE uses the command prompt to execute commands on the victim's machine.^[59][60]

Orz can execute shell commands.^[46] Orz can execute commands with JavaScript.^[46]

Patchwork ran a reverse shell with Meterpreter.^[194] Patchwork used JavaScript code and .SCT files on victim machines.^[70][195]

PHOREAL is capable of creating reverse shell.^[19]

Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.^[49]

PLAINTEE uses cmd.exe to execute commands on the victim’s machine.^[95]

PLEAD has the ability to execute shell commands on the compromised host.^[140]

PlugX allows actors to spawn a reverse shell on a victim.^[66][67]

PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.^[87]

Pony has used batch scripts to delete itself after execution.^[150]

PowerDuke runs cmd.exe /c and sends the output to its C2.^[86]

POWRUNER can execute commands from its C2 server.^[84]

Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c " > %temp%\PM* .tmp 2>&1".^[48]

Pteranodon can execute commands on the victim.^[13]

QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.^[35]

QuasarRAT can launch a remote shell to execute commands on the victim’s machine.^[3]

Ragnar Locker has used cmd.exe and batch scripts to execute commands.^[159]

Rancor has used cmd.exe to execute commmands.^[95]

RATANKBA uses cmd.exe to execute commands.^[76][77]

RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.^[63][38]

Remcos can launch a remote command line to execute commands on the victim’s machine.^[5]

Remexi silently executes received commands with cmd.exe.^[106]

Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.^[110]

RGDoor uses cmd.exe to execute commands on the victim’s machine.^[75]

Rising Sun executed commands using cmd.exe.^[145]

RobbinHood uses cmd.exe on the victim's computer.^[124]

RogueRobin uses Windows Script Components.^[43][44]

RTM uses the command line and rundll32.exe to execute.^[10]

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.^[26]

Ryuk has used cmd.exe to create a Registry entry to establish persistence.^[144]

Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.^[24]

SamSam uses custom batch scripts to execute some of its components.^[105]

SDBot has the ability to use the command shell to execute commands on a compromised host.^[153]

SeaDuke is capable of executing commands.^[101]

Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.^[74]

SEASHARPEE can execute commands on victims.^[21]

ServHelper can execute shell commands against cmd.^[111][112]

ShimRat can be issued a command shell function from the C2.^[146]

Silence has used Windows command-line to run commands.^{[197][198][199]}

SNUGRIDE is capable of executing commands and spawning a reverse shell.^[38]

Soft Cell used the Windows command shell to execute commands.^[202]

Sowbug has used command line during its intrusions.^[177]

SQLRat has used SQL to execute JavaScript and VB scripts on the host system.^[118]

StreamEx has the ability to remotely execute commands.^[57]

Several tools used by Suckfly have been command-line driven.^[179]

SYSCON has the ability to execute commands through cmd on a compromised host.^[154]

TA505 has executed commands using cmd.exe.^[220]

TDTESS provides a reverse shell on the victim.^[30]

TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.^[33][34]

Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.^[176]

Threat Group-3390 has used command-line interfaces for execution.^[16][178]

TinyZBot supports execution from the command-line.^[37]

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.^[104]

Tropic Trooper has used Windows command scripts.^[149]

TSCookie has the ability to execute shell commands on the infected host.^[141]

Turla RPC backdoors have used cmd.exe to execute commands.^[200][201]

TURNEDUP is capable of creating a reverse shell.^[99]

TYPEFRAME can uninstall malware components using a batch script.^[134] TYPEFRAME can execute commands using a shell.^[134]

UBoatRAT can start a command shell.^[82]

Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet^[85]

UPPERCUT uses cmd.exe to execute commands on the victim’s machine.^[56]

USBferry can execute various Windows commands.^[149]

Volgmer can execute commands on the victim's machine.^[41][42]

WEBC2 can open an interactive command shell.^[53]

Wiarp creates a backdoor through which remote attackers can open a command line interface.^[92]

XTunnel has been used to execute remote commands.^[71]

Zebrocy uses cmd.exe to execute commands on the system.^[120]

Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.^[88]

ZLib has the ability to execute shell commands.^[14]

zwShell can launch command-line shells.^[83]

ZxShell can launch a reverse command shell.^{[126][127][128]}

Use application control where appropriate.