ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.[3]
Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.[5]
ADVSTORESHELL can create a remote shell and run a given command.[6][7]
Anchor has used cmd.exe to run its self deletion routine.[8]
APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.[9]
APT18 uses cmd.exe to execute commands on the victim’s machine.[10][11]
An APT28 loader Trojan uses a cmd.exe and batch script to run its payload.[12] The group has also used macros to execute payloads.[13][14][15][16]
APT29 used cmd.exe to execute commands on remote machines.[17][18]
An APT3 downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.[19][20]
APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.[24]
APT41 used cmd.exe /c to execute commands on remote machines.[25]APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.[26]
AuditCred can open a reverse shell on the system to execute commands.[28]
Babuk has the ability to use the command line to control execution on compromised hosts.[29][30]
BackConfig can download and run batch files to execute commands on a compromised host.[32]
Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.[33]
BADNEWS is capable of executing commands via cmd.exe.[34][35]
Bandook is capable of spawning a Windows command shell.[36][37]
Bankshot uses the command-line interface to execute arbitrary commands.[38][39]
Bazar can launch cmd.exe to perform reconnaissance commands.[40][41]
BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.[3]
BISCUIT has a command to launch a command shell on the system.[42]
Bisonal can launch cmd.exe to execute commands on the system.[43][44]
BLACKCOFFEE has the capability to create a reverse shell.[45]
BlackMould can run cmd.exe with parameters.[46]
BLINDINGCAN has executed commands via cmd.exe.[47]
Blue Mockingbird has used batch script files to automate execution and deployment of payloads.[48]
BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.[49]
BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.[50]
BRONZE BUTLER has used batch scripts and the command-line interface for execution.[51]
CALENDAR has a command to run cmd.exe to execute commands.[42]
Cardinal RAT can execute commands.[53]
CARROTBAT has the ability to execute command line arguments on a compromised host.[54]
Caterpillar WebShell can run commands on the compromised asset with CMD functions.[55]
Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.[57]
China Chopper's server component is capable of opening a command terminal.[58][59][60]
Clop can use cmd.exe to help execute commands on the system.[61]
cmd is used to execute programs and other actions at the command-line interface.[62]
Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.[63] The group has used an exploit toolkit known as Threadkit that launches .bat files.[64][65][66][63][67][68]
Cobalt Strike uses a command-line interface to interact with systems.[69][70][71]
Cobian RAT can launch a remote command shell interface for executing commands.[72]
CoinTicker executes a bash script to establish a reverse shell.[73]
Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.[76]
A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.[77]
Crimson has the ability to execute commands with the COMSPEC environment variable.[78]
Dark Caracal has used macros in Word documents that would download a second stage if executed.[80]
DarkComet can launch a remote shell to execute commands on the victim’s machine.[81]
Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.[82]
DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.[84]
Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.[85][21]
Dragonfly 2.0 used various types of scripting to perform operations, including batch scripts.[87][88]
DropBook can execute arbitrary shell commands on the victims' machines.[89][90]
ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.[92]
Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.[93][94]
Emissary has the capability to create a remote shell and execute specified commands.[95]
EnvyScout can use cmd.exe to execute malicious files on compromised hosts.[98]
EvilBunny has an integrated scripting engine to download and execute Lua scripts.[99]
Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.[100]
FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.[102][103]
FIN10 has executed malicious .bat files containing PowerShell commands.[104]
FIN6 has used kill.bat script to disable security tools.[105]
FIN7 used the command prompt to launch commands on the victim’s machine.[106][107]
FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.[108] FIN8 has also executed commands remotely via cmd.[109][110]
Fox Kitten has used cmd.exe likely as a password changing mechanism.[111]
Frankenstein has run a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line.[112]
GALLIUM used the Windows command shell to execute commands.[113]
Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.[114][115]
Gold Dragon uses cmd.exe to execute commands for discovery.[116]
GoldenSpy can execute remote commands via the command-line interface.[117]
GoldMax can spawn a command shell, and execute native commands.[118][119]
Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.[21]
Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.[120]
GravityRAT executes commands remotely on the infected host.[121]
GreyEnergy uses cmd.exe to execute itself in-memory.[103]
GrimAgent can use the Windows Command Shell to execute commands, including its own removal.[122]
HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.[125]
hcdLoader provides command-line access to the compromised system.[126]
Helminth can provide a remote shell. One version of Helminth uses batch scripting.[127]
HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.[129]
Hikit has the ability to create a remote shell and run given commands.[133]
Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.[135] Honeybee used batch scripting.[135]
HOPLIGHT can launch cmd.exe to execute commands on the system.[136]
HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.[137]
HTTPBrowser is capable of spawning a reverse shell on a victim.[138]
httpclient opens cmd.exe on the victim.[2]
Indrik Spider has used batch scripts on victim's machines.[139]
InnaputRAT launches a shell to execute commands on the victim’s machine.[140]
InvisiMole can launch a remote shell to execute commands.[141][142]
JPIN can use the command-line utility cacls.exe to change file permissions.[4]
Kazuar uses cmd.exe to execute commands on the victim’s machine.[147]
Ke3chang has used batch scripts in its malware to install persistence mechanisms.[148]
KeyBoy can launch interactive shells for communicating with the victim machine.[149][150]
KGH_SPY has the ability to set a Registry key to run a cmd.exe command.[152]
Koadic can open an interactive command-shell to perform command line functions on victim machines.[153] Koadic performs most of its operations using Windows Script Host (Jscript) and runs arbitrary shellcode .[153]
KONNI has used cmd.exe execute arbitrary commands on the infected host across different stages of the infection change.[155][156]
Lazarus Group malware uses cmd.exe to execute commands on victims.[157][158][159][160] A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.[161]
LightNeuron is capable of executing commands via cmd.exe.[162]
Linfo creates a backdoor through which remote attackers can start a remote shell.[163]
Lokibot has used cmd /c commands embedded within batch scripts.[164]
LoudMiner used a batch script to run the Linux virtual machine as a service.[166]
Lucifer can issue shell commands to download and execute additional payloads.[167]
Machete has used batch files to initiate additional downloads of malicious files.[168]
Magic Hound has used the command-line interface.[169]
MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.[170]
The Maze encryption process has used batch scripts with various commands.[171][172]
MCMD can launch a console process (cmd.exe) with redirected standard input and output.[173]
MechaFlounder has the ability to run commands on a compromised host.[174]
MegaCortex has used .cmd scripts on the victim's system.[175]
menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.[176][177][178][179] menuPass has used malicious macros embedded inside Office documents to execute files.[180][179]
MirageFox has the capability to execute commands using cmd.exe.[183]
Mis-Type uses cmd.exe to run commands for enumerating the host.[184]
Misdat is capable of providing shell functionality to the attacker to execute commands.[184]
Mivast has the capability to open a remote shell and run basic commands.[185]
MoleNet can execute commands via the command line utility.[89]
MoonWind can execute commands via an interactive command shell.[186] MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.[186]
Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.[189]
MuddyWater has used a custom tool for creating reverse shells.[190]
Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.[191][192]
NanoCore can open a remote command-line interface and execute commands.[193] NanoCore uses JavaScript files.[194]
NavRAT leverages cmd.exe to perform discovery techniques.[195] NavRAT loads malicious shellcode and executes it in memory.[195]
NETEAGLE allows adversaries to execute shell commands on the infected host.[33]
Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.[197]
njRAT can launch a command shell interface for executing commands.[200]
Nomadic Octopus used cmd.exe /c within a malicious macro.[201]
OceanSalt can create a reverse shell on the infected endpoint using cmd.exe.[202] OceanSalt has been executed via malicious macros.[202]
OilRig has used macros to deliver malware such as QUADAGENT and OopsIE.[203][204][205][206][207] OilRig has used batch scripts.[203][204][205][206][207]
Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.[208]
OopsIE uses the command prompt to execute commands on the victim's machine.[205][209]
Operation Wocao has spawned a new cmd.exe process to execute commands.[210]
Orz can execute shell commands.[211] Orz can execute commands with JavaScript.[211]
Patchwork ran a reverse shell with Meterpreter.[213] Patchwork used JavaScript code and .SCT files on victim machines.[35][214]
Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.[216]
PLAINTEE uses cmd.exe to execute commands on the victim’s machine.[217]
PLEAD has the ability to execute shell commands on the compromised host.[218]
PlugX allows actors to spawn a reverse shell on a victim.[138][219]
PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.[221]
Pony has used batch scripts to delete itself after execution.[222]
PowerDuke runs cmd.exe /c and sends the output to its C2.[223]
Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c ".[161]
Pteranodon can execute commands on the victim.[114]
QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.[224][225][226]
QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.[206]
QuasarRAT can launch a remote shell to execute commands on the victim’s machine.[227]
Ragnar Locker has used cmd.exe and batch scripts to execute commands.[228]
RainyDay can use the Windows Command Shell for execution.[196]
RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.[177][232]
Remcos can launch a remote command line to execute commands on the victim’s machine.[233]
Remexi silently executes received commands with cmd.exe.[234]
Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.[235]
REvil can use the Windows command line to delete volume shadow copies and disable recovery.[236][237][238][239]
RGDoor uses cmd.exe to execute commands on the victim’s machine.[240]
Rising Sun executed commands using cmd.exe.[241]
RobbinHood uses cmd.exe on the victim's computer.[242]
RogueRobin uses Windows Script Components.[243][244]
RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.[116]
Ryuk has used cmd.exe to create a Registry entry to establish persistence.[246]
Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.[247]
SamSam uses custom batch scripts to execute some of its components.[248]
Sandworm Team has run the xp_cmdshell command in MS-SQL.[249]
SDBbot has the ability to use the command shell to execute commands on a compromised host.[250]
Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.[42]
SEASHARPEE can execute commands on victims.[252]
ServHelper can execute shell commands against cmd.[253][254]
Seth-Locker can execute commands via the command line shell.[255]
SharpStage can execute arbitrary commands with the command line.[89][90]
ShimRat can be issued a command shell function from the C2.[256]
SideTwist can execute shell commands on a compromised host.[257]
Silence has used Windows command-line to run commands.[258][259][260]
SLOTHFULMEDIA can open a command line to execute commands.[262]
SNUGRIDE is capable of executing commands and spawning a reverse shell.[232]
SQLRat has used SQL to execute JavaScript and VB scripts on the host system.[107]
Several tools used by Suckfly have been command-line driven.[266]
SYSCON has the ability to execute commands through cmd on a compromised host.[54]
TAINTEDSCRIBE can enable Windows CLI access and execute files.[270]
TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.[272]
TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.[273][274]
Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.[275]
Threat Group-3390 has used command-line interfaces for execution.[58][276]
TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.[278]
Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.[279]
Tropic Trooper has used Windows command scripts.[280]
TSCookie has the ability to execute shell commands on the infected host.[281]
Turian can create a remote shell and execute commands using cmd.[282]
Turla RPC backdoors have used cmd.exe to execute commands.[283][284]
TYPEFRAME can uninstall malware components using a batch script.[286] TYPEFRAME can execute commands using a shell.[286]
Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet[288]
UPPERCUT uses cmd.exe to execute commands on the victim’s machine.[179]
Volgmer can execute commands on the victim's machine.[289][290]
WastedLocker has used cmd to execute commands on the system.[291]
WellMess can execute command line scripts received from C2.[292]
Wiarp creates a backdoor through which remote attackers can open a command line interface.[293]
Wizard Spider has used cmd.exe to execute commands on a victim's machine.[294]
Zebrocy uses cmd.exe to execute commands on the system.[296][297]
Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.[298]
ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.[299]