Technique:  Command and Scripting Interpreter:Windows Command Shell
During the 2016 Ukraine Electric Power Attack, It used the xp_cmdshell command in MS-SQL.
4H RAT has the capability to create a remote shell.
ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.
Action RAT can use cmd.exe to execute commands on an infected host.
adbupd can run a copy of cmd.exe.
Following exploitation with LOWBALL malware, It actors created a file containing a list of commands to be executed on the compromised computer.
ADVSTORESHELL can create a remote shell and run a given command.
Anchor has used cmd.exe to run its self deletion routine.
It has used the Windows command shell to execute commands, and batch scripting to automate execution.
It uses cmd.exe to execute commands on the victim’s machine.
An It loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.
An It downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.
It has used cmd.exe for execution.
It has used the command-line interface.
It has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.
It used cmd.exe /c to execute commands on remote machines.It used a batch file to install persistence for the Cobalt Strike BEACON loader.
It has attempted and failed to run Bash commands on a Windows host by passing them to cmd /C.
Astaroth spawns a CMD process to execute commands.
AuditCred can open a reverse shell on the system to execute commands.
AuTo Stealer can use cmd.exe to execute a created batch file.
Babuk has the ability to use the command line to control execution on compromised hosts.
BabyShark has used cmd.exe to execute commands.
BackConfig can download and run batch files to execute commands on a compromised host.
Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.
BADHATCH can use cmd.exe to execute commands on a compromised host.
BADNEWS is capable of executing commands via cmd.exe.
Bandook is capable of spawning a Windows command shell.
Bankshot uses the command-line interface to execute arbitrary commands.
Bazar can launch cmd.exe to perform reconnaissance commands.
BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.
BISCUIT has a command to launch a command shell on the system.
Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.
Black Basta can use cmd.exe to enable shadow copy deletion.
BlackCat can execute commands on a compromised network with the use of cmd.exe.
BLACKCOFFEE has the capability to create a reverse shell.
BlackMould can run cmd.exe with parameters.
BLINDINGCAN has executed commands via cmd.exe.
It has used batch script files to automate execution and deployment of payloads.
BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.
BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.
It has used batch scripts and the command-line interface for execution.
Brute Ratel C4 can use cmd.exe for execution.
Bumblebee can use cmd.exe to drop and run files.
During C0015, the threat actors used cmd.exe to execute commands and run malicious binaries.
During C0017, It used cmd.exe to execute reconnaissance commands.
CALENDAR has a command to run cmd.exe to execute commands.
It has a command to create a reverse shell.
Cardinal RAT can execute commands.
CARROTBAT has the ability to execute command line arguments on a compromised host.
Caterpillar WebShell can run commands on the compromised asset with CMD functions.
ccf32 has used cmd.exe for archiving data and deleting files.
Chaes has used cmd to execute tasks on the system.
The C# implementation of  the CharmPower command execution module can use cmd.
It has used the Windows Command Shell and batch scripts for execution on compromised hosts.
China Chopper's server component is capable of opening a command terminal.
Clambling can use cmd.exe for command execution.
Clop can use cmd.exe to help execute commands on the system.
cmd is used to execute programs and other actions at the command-line interface.
It has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.
Cobalt Strike uses a command-line interface to interact with systems.
Cobian RAT can launch a remote command shell interface for executing commands.
CoinTicker executes a bash script to establish a reverse shell.
Comnie executes BAT scripts.
ComRAT has used cmd.exe to execute commands.
Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.
A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.
Crimson has the ability to execute commands with the COMSPEC environment variable.
Cuba has used cmd.exe /c and batch files for execution.
DanBot has the ability to execute arbitrary commands via cmd.exe.
It has used macros in Word documents that would download a second stage if executed.
DarkComet can launch a remote shell to execute commands on the victim’s machine.
It has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.
DarkTortilla can use cmd.exe to add registry keys for persistence.
DarkWatchman can use cmd.exe to execute commands.
Daserf can execute shell commands.
DEADEYE can run cmd /c copy /y /b C:\Users\public\syslog_6-*.dat C:\Users\public\syslog.dll to combine separated sections of code into a single DLL prior to execution.
DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.
Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.
Dipsind can spawn remote shells.
DnsSystem can use cmd.exe for execution.
DownPaper uses the command line.
It has used various types of scripting to perform operations, including batch scripts.
DropBook can execute arbitrary shell commands on the victims' machines.
Dtrack has used cmd.exe to add a persistent service.
ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.
Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.
It had used cmd.exe and Windows Script Host (wscript) to execute malicious code.
Emissary has the capability to create a remote shell and execute specified commands.
Emotet has used cmd.exe to run a PowerShell script.
Empire has modules for executing scripts.
EnvyScout can use cmd.exe to execute malicious files on compromised hosts.
EvilBunny has an integrated scripting engine to download and execute Lua scripts.
Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.
Felismus uses command line for execution.
FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.
It has executed malicious .bat files containing PowerShell commands.
It has leveraged xp_cmdshell and Windows Command Shell to execute commands on a compromised machine. It has also attempted to leverage the ‘xp_cmdshell’ SQL procedure to execute remote commands on internal MS-SQL servers.
It has used kill.bat script to disable security tools.
It used the command prompt to launch commands on the victim’s machine.
It has used a Batch file to automate frequently executed post compromise cleanup activities. It has also executed commands remotely via cmd.exe.
Flagpro can use cmd.exe to execute commands received from C2.
FlawedAmmyy has used cmd to execute commands on a compromised host.
It has used cmd.exe likely as a password changing mechanism.
During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line
FunnyDream can use cmd.exe for execution on remote hosts.
During FunnyDream, the threat actors used cmd.exe to execute the wmiexec.vbs script.
It used the Windows command shell to execute commands.
It has used various batch scripts to establish C2 and download additional files. It's backdoor malware has also been written to a batch file.
Gelsemium can use a batch script to delete itself.
Gold Dragon uses cmd.exe to execute commands for discovery.
GoldenSpy can execute remote commands via the command-line interface.
GoldMax can spawn a command shell, and execute native commands.
Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.
It malware can use cmd.exe to download and execute payloads and to execute commands on the system.
GravityRAT executes commands remotely on the infected host.
GreyEnergy uses cmd.exe to execute itself in-memory.
GrimAgent can use the Windows Command Shell to execute commands, including its own removal.
H1N1 kills and disables services by using cmd.exe.
It has used cmd.exe to execute commands on the victim's machine.
HARDRAIN uses cmd.exe to execute netshcommands.
HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.
hcdLoader provides command-line access to the compromised system.
Helminth can provide a remote shell. One version of Helminth uses batch scripting.
HermeticWiper can use cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1 to deploy on an infected system.
HermeticWizard can use cmd.exe for execution on compromised hosts.
Hi-Zor has the ability to create a reverse shell.
HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.
It used cmd.exe for execution.
Hikit has the ability to create a remote shell and run given commands.
HOMEFRY uses a command-line interface.
HOPLIGHT can launch cmd.exe to execute commands on the system.
HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.
HTTPBrowser is capable of spawning a reverse shell on a victim.
httpclient opens cmd.exe on the victim.
It has used batch scripts on victim's machines.
InnaputRAT launches a shell to execute commands on the victim’s machine.
InvisiMole can launch a remote shell to execute commands.
Ixeshe is capable of executing commands via cmd.
JCry has used cmd.exe to launch PowerShell.
JHUHUGIT uses a .bat file to execute a .dll.
JPIN can use the command-line utility cacls.exe to change file permissions.
jRAT has command line access.
Kasidet can execute commands using cmd.exe.
Kazuar uses cmd.exe to execute commands on the victim’s machine.
It has used batch scripts in its malware to install persistence mechanisms.
Kevin can use a renamed image of cmd.exe for execution.
KeyBoy can launch interactive shells for communicating with the victim machine.
KEYMARBLE can execute shell commands using cmd.exe.
KGH_SPY has the ability to set a Registry key to run a cmd.exe command.
It has executed Windows commands by using cmd and running batch scripts.
Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.
KOCTOPUS has used cmd.exe and batch files for execution.
KOMPROGO is capable of creating a reverse shell.
KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.
It malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by It uses a batch file mechanism to delete its binaries from the system.
It has used batch files to deploy open-source and multi-stage RATs.
LightNeuron is capable of executing commands via cmd.exe.
Linfo creates a backdoor through which remote attackers can start a remote shell.
Lizar has a command to open the command-line on the infected system.
Lokibot has used cmd /c commands embedded within batch scripts.
LookBack executes the cmd.exe command.
LoudMiner used a batch script to run the Linux virtual machine as a service.
Lucifer can issue shell commands to download and execute additional payloads.
It has used batch files to initiate additional downloads of malicious files.
Mafalda can execute shell commands using cmd.exe.
It has used the command-line interface for code execution.
MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.
The Maze encryption process has used batch scripts with various commands.
MCMD can launch a console process (cmd.exe) with redirected standard input and output.
MechaFlounder has the ability to run commands on a compromised host.
MegaCortex has used .cmd scripts on the victim's system.
It executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. It has used malicious macros embedded inside Office documents to execute files.
It has used the Windows command line to execute commands.
Metamorfo has used cmd.exe /c to execute files.
Meteor can run set.bat, update.bat, cache.bat, bcd.bat, msrun.bat, and similar scripts.
Micropsia creates a command-line shell using cmd.exe.
Milan can use cmd.exe for discovery actions on a targeted system.
MirageFox has the capability to execute commands using cmd.exe.
Mis-Type has used cmd.exe to run commands on a compromised host.
Misdat is capable of providing shell functionality to the attacker to execute commands.
Mivast has the capability to open a remote shell and run basic commands.
MoleNet can execute commands via the command line utility.
MoonWind can execute commands via an interactive command shell. MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.
More_eggs has used cmd.exe for execution.
Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.
It has used a custom tool for creating reverse shells.
MURKYTOP uses the command-line interface.
It has executed HTA files via cmd.exe, and used batch scripts for collection.
NanoCore can open a remote command-line interface and execute commands. NanoCore uses JavaScript files.
NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory.
Nebulae can use CMD to execute a process.
NETEAGLE allows adversaries to execute shell commands on the infected host.
Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.
NETWIRE can issue commands using cmd.exe.
During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.
njRAT can launch a command shell interface for executing commands.
It used cmd.exe /c within a malicious macro.
OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros.
It has used macros to deliver malware such as QUADAGENT and OopsIE. It has used batch scripts.
Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.
OopsIE uses the command prompt to execute commands on the victim's machine.
During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.
During Operation Dream Job, It launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.
During Operation Honeybee, various implants used batch scripting and cmd.exe for execution.
During Operation Wocao, threat actors spawned a new cmd.exe process to execute commands.
Orz can execute shell commands. Orz can execute commands with JavaScript.
Out1 can use native command line for execution.
OutSteel has used cmd.exe to scan a compromised host for specific file extensions.
It ran a reverse shell with Meterpreter. It used JavaScript code and .SCT files on victim machines.
PcShare can execute cmd commands on a compromised host.
Peppy has the ability to execute shell commands.
PHOREAL is capable of creating reverse shell.
PingPull can use cmd.exe to run various commands as a reverse shell.
Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.
PLAINTEE uses cmd.exe to execute commands on the victim’s machine.
PLEAD has the ability to execute shell commands on the compromised host.
PlugX allows actors to spawn a reverse shell on a victim.
PoetRAT has called cmd through a Word document macro.
PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.
Pony has used batch scripts to delete itself after execution.
PowerDuke runs cmd.exe /c and sends the output to its C2.
POWRUNER can execute commands from its C2 server.
Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c " > %temp%\PM* .tmp 2>&1".
Pteranodon can use cmd.exe for execution on victim systems.
PyDCrypt has used cmd.exe for execution.
QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.
QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.
QuasarRAT can launch a remote shell to execute commands on the victim’s machine.
Ragnar Locker has used cmd.exe and batch scripts to execute commands.
RainyDay can use the Windows Command Shell for execution.
It has used cmd.exe to execute commmands.
RATANKBA uses cmd.exe to execute commands.
RCSession can use cmd.exe for execution on compromised hosts.
RDAT has executed commands using cmd.exe /c.
RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.
Remcos can launch a remote command line to execute commands on the victim’s machine.
Remexi silently executes received commands with cmd.exe.
Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.
REvil can use the Windows command line to delete volume shadow copies and disable recovery.
RGDoor uses cmd.exe to execute commands on the victim’s machine.
Rising Sun has executed commands using cmd.exe /c "<command> > <%temp%>\AM<random>. tmp" 2>&1.
RobbinHood uses cmd.exe on the victim's computer.
RogueRobin uses Windows Script Components.
It uses the command line and rundll32.exe to execute.
RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.
Ryuk has used cmd.exe to create a Registry entry to establish persistence.
S-Type has provided the ability to execute shell commands on a compromised host.
Saint Bot has used cmd.exe and .bat scripts for execution.
Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.
SamSam uses custom batch scripts to execute some of its components.
Sardonic has the ability to run cmd.exe or other interactive processes on a compromised computer.
SDBbot has the ability to use the command shell to execute commands on a compromised host.
SeaDuke is capable of executing commands.
Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.
SEASHARPEE can execute commands on victims.
ServHelper can execute shell commands against cmd.
Seth-Locker can execute commands via the command line shell.
Shark has the ability to use CMD to execute commands.
SharpDisco can use cmd.exe to execute plugins and to send command output to  specified SMB shares.
SharpStage can execute arbitrary commands with the command line.
ShimRat can be issued a command shell function from the C2.
SideTwist can execute shell commands on a compromised host.
It has used Windows command-line to run commands.
SILENTTRINITY can use cmd.exe to enable lateral movement using DCOM.
Siloscape can run cmd through an IRC channel.
SLOTHFULMEDIA can open a command line to execute commands.
Small Sieve can use cmd.exe to execute commands on a victim's system.
SNUGRIDE is capable of executing commands and spawning a reverse shell.
During the SolarWinds Compromise, It used cmd.exe to execute commands on remote machines.
It has used command line during its intrusions.
Spark can use cmd.exe to run commands.
SQLRat has used SQL to execute JavaScript and VB scripts on the host system.
Squirrelwaffle has used cmd.exe for execution.
STARWHALE has the ability to execute commands via cmd.exe.
StreamEx has the ability to remotely execute commands.
StrifeWater can execute shell commands using cmd.exe.
Several tools used by It have been command-line driven.
SUGARUSH has used cmd for execution on an infected host.
SYSCON has the ability to execute commands through cmd on a compromised host.
It has executed commands using cmd.exe.
It has used cmd.exe to execute commands.
Taidoor can copy cmd.exe into the system temp folder.
TAINTEDSCRIBE can enable Windows CLI access and execute files.
Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.
TDTESS provides a reverse shell on the victim.
It has used batch scripts to download tools and executing cryptocurrency miners.
TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.
It actors spawned shells on remote systems on a victim network to execute commands.
It has used command-line interfaces for execution.
TinyIt has been installed using a .bat file.
TinyZBot supports execution from the command-line.
TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.
Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.
It has used Windows command scripts.
TSCookie has the ability to execute shell commands on the infected host.
Turian can create a remote shell and execute commands using cmd.
It RPC backdoors have used cmd.exe to execute commands.
TURNEDUP is capable of creating a reverse shell.
TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell.
UBoatRAT can start a command shell.
Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet
UPPERCUT uses cmd.exe to execute commands on the victim’s machine.
Uroburos has the ability to use the command line for execution on the targeted system.
USBferry can execute various Windows commands.
Volgmer can execute commands on the victim's machine.
It has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.
WarzoneRAT can use cmd.exe to execute malicious code.
WastedLocker has used cmd to execute commands on the system.
WEBC2 can open an interactive command shell.
WellMess can execute command line scripts received from C2.
WhisperGate can use cmd.exe to execute commands.
Wiarp creates a backdoor through which remote attackers can open a command line interface.
It has used cmd.exe to execute commands on a victim's machine.
Woody RAT can execute commands using cmd.exe.
xCaon has a command to start an interactive shell.
XTunnel has been used to execute remote commands.
Zebrocy uses cmd.exe to execute commands on the system.
Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.
ItM has used a tool to open a Windows Command Shell on a remote host.
ZLib has the ability to execute shell commands.
zwShell can launch command-line shells.
ZxShell can launch a reverse command shell.