sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
PowerPunch has the ability to execute through PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
PowerShower is a backdoor written in PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
PowerSploit modules are written in and executed via PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Prestige can use PowerShell for payload execution on targeted systems.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Pupy has a module for loading and executing PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
PyDCrypt has attempted to execute with PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Pysa has used Powershell scripts to deploy its ransomware.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
QUADAGENT uses PowerShell scripts for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
QakBot can use PowerShell to download and execute payloads.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
REvil has used PowerShell to delete volume shadow copies and download files.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
RegDuke can extract and execute PowerShell scripts from C2 communications.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Revenge RAT uses the PowerShell command `Reflection.Assembly` to load itself into memory to aid in execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates `%APPDATA%\OneDrive.bat` and saves the following string to it:`powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”`.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
SHARPSTATS has the ability to employ a custom PowerShell script.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
SILENTTRINITY can use PowerShell to execute commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
SMOKEDHAM can execute Powershell commands sent from its C2 server.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
SQLRat has used PowerShell to create a Meterpreter session.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Saint Bot has used PowerShell for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Sardonic has the ability to execute PowerShell commands on a compromised machine.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
ServHelper has the ability to execute a PowerShell script to get information from the infected host.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
SharpStage can execute arbitrary commands with PowerShell.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Snip3 can use a PowerShell script for second-stage execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Socksbot can write and execute PowerShell scripts.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Squirrelwaffle has used PowerShell to execute its payload.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
StrongPity can use PowerShell to add files to the Windows Defender exclusions list.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Valak has used PowerShell to download additional modules.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
WarzoneRAT can use PowerShell to download files and execute commands.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
WellMess can execute PowerShell scripts received from C2.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Woody RAT can execute PowerShell commands and scripts with the use of .NET DLL, `WoodyPowerSession`.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Zeus Panda uses PowerShell to download and execute the payload.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
njRAT has executed PowerShell commands via auto-run registry key persistence.
Technique: T1059.001 Command and Scripting Interpreter: PowerShell, Tactic: TA0002 Execution
Bundlore can use AppleScript to inject malicious JavaScript into a browser.
Technique: T1059.002 Command and Scripting Interpreter: AppleScript, Tactic: TA0002 Execution
Dok uses AppleScript to create a login item for persistence.
Technique: T1059.002 Command and Scripting Interpreter: AppleScript, Tactic: TA0002 Execution
ThiefQuest uses AppleScript's `osascript -e` command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon.
Technique: T1059.002 Command and Scripting Interpreter: AppleScript, Tactic: TA0002 Execution
macOS.OSAMiner has used `osascript` to call itself via the `do shell script` command in the Launch Agent `.plist` file.
Technique: T1059.002 Command and Scripting Interpreter: AppleScript, Tactic: TA0002 Execution
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `xp_cmdshell` command in MS-SQL.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During C0017, APT41 used `cmd.exe` to execute reconnaissance commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
During the SolarWinds Compromise, APT29 used `cmd.exe` to execute commands on remote machines.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
APT18 uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
An APT3 downloader uses the Windows command `"cmd.exe" /C whoami`. The group also uses a tool to execute commands on remote computers.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
APT32 has used cmd.exe for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
APT37 has used the command-line interface.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
APT41 used `cmd.exe /c` to execute commands on remote machines.
APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
APT5 has used cmd.exe for execution on compromised systems.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to `cmd /C`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BRONZE BUTLER has used batch scripts and the command-line interface for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Blue Mockingbird has used batch script files to automate execution and deployment of payloads.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Dark Caracal has used macros in Word documents that would download a second stage if executed.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Dragonfly has used various types of scripting to perform operations, including batch scripts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Ember Bear had used `cmd.exe` and Windows Script Host (wscript) to execute malicious code.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
FIN10 has executed malicious .bat files containing PowerShell commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
FIN13 has leveraged `xp_cmdshell` and Windows Command Shell to execute commands on a compromised machine. FIN13 has also attempted to leverage the ‘xp_cmdshell’ SQL procedure to execute remote commands on internal MS-SQL servers.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
FIN6 has used `kill.bat` script to disable security tools.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
FIN7 used the command prompt to launch commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via `cmd.exe`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Fox Kitten has used cmd.exe likely as a password changing mechanism.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
GALLIUM used the Windows command shell to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HAFNIUM has used `cmd.exe` to execute commands on the victim's machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Higaisa used `cmd.exe` for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Indrik Spider has used batch scripts on victim's machines.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Ke3chang has used batch scripts in its malware to install persistence mechanisms.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Kimsuky has executed Windows commands by using `cmd` and running batch scripts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
LazyScripter has used batch files to deploy open-source and multi-stage RATs.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Machete has used batch files to initiate additional downloads of malicious files.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Magic Hound has used the command-line interface for code execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Metador has used the Windows command line to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
MuddyWater has used a custom tool for creating reverse shells.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Nomadic Octopus used `cmd.exe /c` within a malicious macro.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Rancor has used cmd.exe to execute commmands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Silence has used Windows command-line to run commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Sowbug has used command line during its intrusions.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Several tools used by Suckfly have been command-line driven.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TA505 has executed commands using `cmd.exe`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TA551 has used `cmd.exe` to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Threat Group-3390 has used command-line interfaces for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ToddyCat has used .bat scripts and `cmd` for execution on compromised hosts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Tropic Trooper has used Windows command scripts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Turla RPC backdoors have used cmd.exe to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Wizard Spider has used `cmd.exe` to execute commands on a victim's machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
4H RAT has the capability to create a remote shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ADVSTORESHELL can create a remote shell and run a given command.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Action RAT can use `cmd.exe` to execute commands on an infected host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Akira executes from the Windows command line and can take various arguments for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Anchor has used cmd.exe to run its self deletion routine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Astaroth spawns a CMD process to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
AuTo Stealer can use `cmd.exe` to execute a created batch file.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
AuditCred can open a reverse shell on the system to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BADHATCH can use `cmd.exe` to execute commands on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BADNEWS is capable of executing commands via cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BISCUIT has a command to launch a command shell on the system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BLACKCOFFEE has the capability to create a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BLINDINGCAN has executed commands via cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Babuk has the ability to use the command line to control execution on compromised hosts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BabyShark has used cmd.exe to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BackConfig can download and run batch files to execute commands on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Bandook is capable of spawning a Windows command shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Bankshot uses the command-line interface to execute arbitrary commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Bazar can launch cmd.exe to perform reconnaissance commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Black Basta can use `cmd.exe` to enable shadow copy deletion.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BlackCat can execute commands on a compromised network with the use of `cmd.exe`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BlackMould can run cmd.exe with parameters.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Brute Ratel C4 can use cmd.exe for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Bumblebee can use `cmd.exe` to drop and run files.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
CALENDAR has a command to run cmd.exe to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
CARROTBAT has the ability to execute command line arguments on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Carbanak has a command to create a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Cardinal RAT can execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Caterpillar WebShell can run commands on the compromised asset with CMD functions.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Chaes has used cmd to execute tasks on the system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
The C# implementation of  the CharmPower command execution module can use `cmd`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
China Chopper's server component is capable of opening a command terminal.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Clambling can use cmd.exe for command execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Clop can use cmd.exe to help execute commands on the system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Cobalt Strike uses a command-line interface to interact with systems.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Cobian RAT can launch a remote command shell interface for executing commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
CoinTicker executes a bash script to establish a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ComRAT has used `cmd.exe` to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Comnie executes BAT scripts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
A module in CozyCar allows arbitrary commands to be executed by invoking `C:\Windows\System32\cmd.exe`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Crimson has the ability to execute commands with the COMSPEC environment variable.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Cuba has used `cmd.exe /c` and batch files for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DEADEYE can run `cmd /c copy /y /b C:\Users\public\syslog_6-*.dat C:\Users\public\syslog.dll` to combine separated sections of code into a single DLL prior to execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DanBot has the ability to execute arbitrary commands via `cmd.exe`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DarkComet can launch a remote shell to execute commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DarkGate uses a malicious Windows Batch script to run the Windows `code` utility to retrieve follow-on script payloads.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DarkTortilla can use `cmd.exe` to add registry keys for persistence.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DarkWatchman can use `cmd.exe` to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Daserf can execute shell commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Dipsind can spawn remote shells.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DnsSystem can use `cmd.exe` for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DownPaper uses the command line.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
DropBook can execute arbitrary shell commands on the victims' machines.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Dtrack has used `cmd.exe` to add a persistent service.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Emissary has the capability to create a remote shell and execute specified commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Emotet has used cmd.exe to run a PowerShell script.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Empire has modules for executing scripts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
EnvyScout can use cmd.exe to execute malicious files on compromised hosts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
EvilBunny has an integrated scripting engine to download and execute Lua scripts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Felismus uses command line for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Flagpro can use `cmd.exe` to execute commands received from C2.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
FlawedAmmyy has used `cmd` to execute commands on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
FunnyDream can use `cmd.exe` for execution on remote hosts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Gelsemium can use a batch script to delete itself.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Gold Dragon uses cmd.exe to execute commands for discovery.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
GoldMax can spawn a command shell, and execute native commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
GoldenSpy can execute remote commands via the command-line interface.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
GravityRAT executes commands remotely on the infected host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
GreyEnergy uses cmd.exe to execute itself in-memory.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
GrimAgent can use the Windows Command Shell to execute commands, including its own removal.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
H1N1 kills and disables services by using cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HARDRAIN uses cmd.exe to execute `netsh`commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HOMEFRY uses a command-line interface.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HOPLIGHT can launch cmd.exe to execute commands on the system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HTTPBrowser is capable of spawning a reverse shell on a victim.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Helminth can provide a remote shell. One version of Helminth uses batch scripting.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HermeticWizard can use `cmd.exe` for execution on compromised hosts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Hi-Zor has the ability to create a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Hikit has the ability to create a remote shell and run given commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
HotCroissant can remotely open applications on the infected host with the `ShellExecuteA` command.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
InnaputRAT launches a shell to execute commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
InvisiMole can launch a remote shell to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Ixeshe is capable of executing commands via cmd.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
JCry has used `cmd.exe` to launch PowerShell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
JHUHUGIT uses a .bat file to execute a .dll.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
JPIN can use the command-line utility cacls.exe to change file permissions.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
KEYMARBLE can execute shell commands using cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
KGH_SPY has the ability to set a Registry key to run a cmd.exe command.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
KOCTOPUS has used `cmd.exe` and batch files for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
KOMPROGO is capable of creating a reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Kasidet can execute commands using cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Kazuar uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Kevin can use a renamed image of `cmd.exe` for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
KeyBoy can launch interactive shells for communicating with the victim machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
LightNeuron is capable of executing commands via cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Linfo creates a backdoor through which remote attackers can start a remote shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Lizar has a command to open the command-line on the infected system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Lokibot has used `cmd /c` commands embedded within batch scripts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
LookBack executes the `cmd.exe` command.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
LoudMiner used a batch script to run the Linux virtual machine as a service.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Lucifer can issue shell commands to download and execute additional payloads.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
MCMD can launch a console process (cmd.exe) with redirected standard input and output.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
MURKYTOP uses the command-line interface.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Mafalda can execute shell commands using `cmd.exe`.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
The Maze encryption process has used batch scripts with various commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
MechaFlounder has the ability to run commands on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
MegaCortex has used `.cmd` scripts on the victim's system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Metamorfo has used `cmd.exe /c` to execute files.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Meteor can run `set.bat`, `update.bat`, `cache.bat`, `bcd.bat`, `msrun.bat`, and similar scripts.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Micropsia creates a command-line shell using cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Milan can use `cmd.exe` for discovery actions on a targeted system.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
MirageFox has the capability to execute commands using cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Mis-Type has used `cmd.exe` to run commands on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Misdat is capable of providing shell functionality to the attacker to execute commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Mivast has the capability to open a remote shell and run basic commands.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
MoleNet can execute commands via the command line utility.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
MoonWind can execute commands via an interactive command shell. MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
More_eggs has used cmd.exe for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
NETEAGLE allows adversaries to execute shell commands on the infected host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
NETWIRE can issue commands using cmd.exe.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
NanoCore can open a remote command-line interface and execute commands. NanoCore uses JavaScript files.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Nebulae can use CMD to execute a process.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
OopsIE uses the command prompt to execute commands on the victim's machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Orz can execute shell commands. Orz can execute commands with JavaScript.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
Out1 can use native command line for execution.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
OutSteel has used `cmd.exe` to scan a compromised host for specific file extensions.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PHOREAL is capable of creating reverse shell.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PLAINTEE uses cmd.exe to execute commands on the victim’s machine.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PLEAD has the ability to execute shell commands on the compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
POWRUNER can execute commands from its C2 server.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution
PcShare can execute `cmd` commands on a compromised host.
Technique: T1059.003 Command and Scripting Interpreter: Windows Command Shell, Tactic: TA0002 Execution