Forensia CTI Core

About

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.

Platforms: WindowsParent: T1059 Command and Scripting InterpreterMITRE ATT&CK ↗

Used by actors

73 known groups

G0004 Ke3chang G0006 APT1 G0007 APT28 G0010 Turla G0012 Darkhotel G0018 admin@338 G0022 APT3 G0026 APT18 G0027 Threat Group-3390 G0028 Threat Group-1314 G0032 Lazarus Group G0035 Dragonfly G0037 FIN6 G0039 Suckfly G0040 Patchwork G0045 menuPass G0046 FIN7 G0047 Gamaredon Group G0049 OilRig G0050 APT32 G0051 FIN10 G0054 Sowbug G0059 Magic Hound G0060 BRONZE BUTLER G0061 FIN8 G0067 APT37 G0069 MuddyWater G0070 Dark Caracal G0075 Rancor G0078 Gorgon Group G0080 Cobalt Group G0081 Tropic Trooper G0082 APT38 G0090 WIRTE G0091 Silence G0092 TA505 G0093 GALLIUM G0094 Kimsuky G0095 Machete G0096 APT41 G0102 Wizard Spider G0108 Blue Mockingbird G0114 Chimera G0117 Fox Kitten G0119 Indrik Spider G0125 HAFNIUM G0126 Higaisa G0127 TA551 G0128 ZIRCONIUM G0129 Mustang Panda G0133 Nomadic Octopus G0139 TeamTNT G0140 LazyScripter G0143 Aquatic Panda G1013 Metador G1016 FIN13 G1017 Volt Typhoon G1021 Cinnamon Tempest G1022 ToddyCat G1023 APT5 G1030 Agrius G1031 Saint Bear G1032 INC Ransom G1035 Winter Vivern G1037 TA577 G1039 RedCurl G1040 Play G1043 BlackByte G1046 Storm-1811 G1048 UNC3886 G1051 Medusa Group G1052 Contagious Interview G1054 MirrorFace

Software

295 malware/tools implement this

TinyZBotHikitTaidoorPoisonIvyPlugXIxesheBISCUITChina ChopperUroburosCALENDARCarbanakBACKSPACENETEAGLEJHUHUGITADVSTORESHELLCozyCarSeaDuke4H RAThttpclientBLACKCOFFEEHTTPBrowserhcdLoaderSakulaMivastEmissaryMisdatMis-TypeS-TypeZLibHi-ZorKasidetTrojan.KaraganycmdWEBC2CrimsonXTunnelPisloaderComRATBADNEWSH1N1PowerDukeStreamExTEXTMATEPteranodonRTMMoonWindRedLeavesCobalt StrikeKOMPROGOPHOREALSNUGRIDETDTESSHelminthFelismusVolgmerPOWRUNERSEASHARPEEDownPaperDaserfNETWIRETURNEDUPDipsindJPINadbupdWiarpLinfoUmbreonOrzHOMEFRYMURKYTOPBandookGravityRATProxysvcBankshotRATANKBADealersChoiceComnieHARDRAINNavRATGold DragonKoadicZebrocyRunningRATPLAINTEEMosquitoRGDoorInnaputRATInvisiMoleQuasarRATTYPEFRAMEOopsIEKazuarTrickBotFELIXROOTBisonalQUADAGENTRogueRobinKEYMARBLEUPPERCUTMirageFoxjRATMore_eggsZeus PandaRemcosUBoatRATDarkCometNanoCoreCobian RATMicropsiaGreyEnergyExaramel for WindowsSeasaltOceanSaltAuditCredCardinal RATzwShellDenisKONNIBONDUPDATEREmpireEmotetCoinTickerSamSamAstarothRemexiHOPLIGHTRevenge RATFlawedAmmyyServHelpernjRATKeyBoyJCrySQLRatHAWKBALLHiddenWaspLightNeuronEvilBunnyRobbinHoodZxShellBabySharkPoetRATHotCroissantPLEADTSCookieOkrumShimRatRyukLokibotRising SunMazeLoudMinerUSBferryPonyMetamorfoNetwalkerMechaFlounderSDBbotCARROTBATSYSCONABKBBKBackConfigGoopyRagnar LockerGoldenSpyRDATREvilMCMDAnchorWellMessBLINDINGCANKGH_SPYLuciferSLOTHFULMEDIABazarSparkSharpStageDropBookMoleNetEgregorBlackMouldDtrackCaterpillar WebShellContiMegaCortexLookBackTAINTEDSCRIBEGoldMaxECCENTRICBANDWAGONOut1SideTwistClopWastedLockerSiloscapeCubaRainyDayNebulaeChaesGrimAgentEnvyScoutBabukSeth-LockerPeppyTurianQakBotBoxCaonMarkiRATxCaonClamblingRCSessionGelsemiumTinyTurlaKOCTOPUSWarzoneRATDarkWatchmanCharmPowerLizarMeteorWhisperGateSILENTTRINITYFlagproHermeticWiperHermeticWizardTarraskDanBotMilanOutSteelSaint BotSharkKevinDnsSystemAction RATAuTo StealerSquirrelwafflePingPullPyDCryptStrifeWaterSmall SieveSTARWHALEBumblebeeccf32FunnyDreamSUGARUSHPcShareDEADEYEMafaldaBrute Ratel C4Woody RATDarkTortillaBlackCatBlack BastaBADHATCHSardonicAsyncRATSharpDiscoSamuraiDarkGateAkiraRaspberry RobinIPsec HelperMultiLayer WiperLunarWebPikabotNightdoorROADSWEEPCovenantManjusakaDUSTTRAPLatrodectusSampleCheck5000ODAgentOilBoosterMagicRATStrelaStealerKapekaMegazordTAMECATTroll StealerLockBit 2.0HannotogRansomHubPUBLOADHavocTONESHELLRedLine StealerQilinMedusa RansomwareEmbargoSystemBCDiskpartHTTPTroyHeartCryptIronWindMuddyViperLAMEHUG

Corpus indicators tagged with this technique

1,180 indicators in the corpus carry T1059.003.

Indicator	Type	Family	Sev	Src
cve-2026-4368	cve	ransomware	85	1
cve-2023-44976	cve	ransomware	85	2
1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984	hash	ransomware	80	2
fab69acd743f4111b749e3268690825c38822e62	hash	—	80	2
99813f3d0625e880158c68039c0e2fbf488db0be3db77cd1ce6d382644193f0e	hash	—	80	2
e5c4e634b2f443f783cae1b5e8247a1069df0c9f	hash	ransomware	80	2
61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f	hash	phishing	80	2
08060143ea9b55b480746b415af22e3a	hash	ransomware	80	1
3d1158884fb339b3328bd330fcc27598e1f1c94bcac39e75d1a272afa4deee1a	sha256	ransomware	80	1
44f6101dd8171133f53317bfd752300e	hash	—	80	2
a7bd8869293212e1671df90d2d41b96d4933eb9408b1111bd830e111a91bb202	hash	phishing	80	2
ac66c2d47cdefb221822b9074c9810434e8da702a0694139aa9177557e6b292b	hash	ransomware	80	1
b0e292346b4ab3f83fadd8abcce7cfc5b9d50ef73ad141e8bc4a4689fee13504	hash	ransomware	80	2
75635009a00cb26d2f532ad974ede59785a18e4b30132a1f585108589394ba5a	hash	ransomware	80	1
55d6238b01a177e25eb7d53c943f3abea64ec073	hash	phishing	80	2
4c357a29b202b77e7db190d359ead2dfd3f8869c6808b96bfa8bee82525bb2a2	hash	ransomware	80	1
9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470	sha256	—	80	1
221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9	sha256	—	80	1
b148626849c11dd5b3230632a38a6302	hash	ransomware	80	2
46b2155c1e71b840d4b7a2e94410b89a61e2446523e6f497206d402eb02e0e93	hash	ransomware	80	1
15d1002d9935fbfc9dfc65eb70fe4ecc0943c784	hash	ransomware	80	1
a08d8e63b0cd3638fb40b8e6da546e26da69439597565827f9cec87915f78568	sha256	ransomware	80	1
107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21	sha256	—	80	1
e4ccb2328c06710a7f0254cb6315e1b106396b0ff525f9cf3eada6e85d285c1c	sha256	—	80	1
6870e3bbf2447c96d21682caf943cf31c2e8c21c8cfb91a5092eab1c9e5f19ae	hash	ransomware	80	1
e5e43b0830369c39fab45363486da4d21a98c5097ea262c9816997f11c73c1c4	hash	phishing	80	2
6c6cbed6aad96564ed87094785be07a1	hash	phishing	80	2
a5a5b6257304eefe5212edfd8c0ad27f77357c5046a7acb8eb7ba72ed4bad9e0	hash	ransomware	80	1
24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54	hash	—	80	2
ced6b0f44410f6133ad63b61e04613a8b56cc3338d7b34497540e9541163e7ec	hash	ransomware	80	1

Showing the top 30 by severity of 1,180.