MITRE ATT&CK - Техника Командная оболочка Windows

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Command and Scripting Interpreter: Командная оболочка Windows

Other sub-techniques of Command and Scripting Interpreter (8)

ID	Название
.001	PowerShell
.002	AppleScript
.003	Командная оболочка Windows
.004	Командная оболочка Unix
.005	Visual Basic
.006	Python
.007	JavaScript/JScript
.008	Интерпретаторы командной строки сетевых устройств

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.(Citation: SSH in Windows) Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.

ID: T1059.003

Относится к технике: T1059

Тактика(-и): Execution

Платформы: Windows

Требуемые разрешения: User

Источники данных: Command: Command Execution, Process: Process Creation

Версия: 1.2

Дата создания: 09 Mar 2020

Последнее изменение: 26 Jul 2021

Название	Описание
Примеры процедур
SeaDuke	SeaDuke is capable of executing commands.(Citation: Unit 42 SeaDuke 2015)
Lazarus Group	Lazarus Group malware uses cmd.exe to execute commands on a compromised host.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: US-CERT SHARPKNOT June 2018)(Citation: Qualys LolZarus) A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.(Citation: McAfee GhostSecret)
InnaputRAT	InnaputRAT launches a shell to execute commands on the victim’s machine.(Citation: ASERT InnaputRAT April 2018)
Daserf	Daserf can execute shell commands.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)
CozyCar	A module in CozyCar allows arbitrary commands to be executed by invoking `C:\Windows\System32\cmd.exe`.(Citation: F-Secure CozyDuke)
OutSteel	OutSteel has used `cmd.exe` to scan a compromised host for specific file extensions.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Orz	Orz can execute shell commands.(Citation: Proofpoint Leviathan Oct 2017) Orz can execute commands with JavaScript.(Citation: Proofpoint Leviathan Oct 2017)
BackConfig	BackConfig can download and run batch files to execute commands on a compromised host.(Citation: Unit 42 BackConfig May 2020)
FlawedAmmyy	FlawedAmmyy has used `cmd` to execute commands on a compromised host.(Citation: Korean FSI TA505 2020)
Lizar	Lizar has a command to open the command-line on the infected system.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021)
BoxCaon	BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.(Citation: Checkpoint IndigoZebra July 2021)
APT29	APT29 used `cmd.exe` to execute commands on remote machines.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)
Pisloader	Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.(Citation: Palo Alto DNS Requests)
OceanSalt	OceanSalt can create a reverse shell on the infected endpoint using cmd.exe.(Citation: McAfee Oceansalt Oct 2018) OceanSalt has been executed via malicious macros.(Citation: McAfee Oceansalt Oct 2018)
Seth-Locker	Seth-Locker can execute commands via the command line shell.(Citation: Trend Micro Ransomware February 2021)
Anchor	Anchor has used cmd.exe to run its self deletion routine.(Citation: Cyberreason Anchor December 2019)
	During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.(Citation: FoxIT Wocao December 2019)
CALENDAR	CALENDAR has a command to run cmd.exe to execute commands.(Citation: Mandiant APT1 Appendix)
QakBot	QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.(Citation: Crowdstrike Qakbot October 2020)(Citation: ATT QakBot April 2021)(Citation: Kaspersky QakBot September 2021)
HermeticWizard	HermeticWizard can use `cmd.exe` for execution on compromised hosts.(Citation: ESET Hermetic Wizard March 2022)
NanoCore	NanoCore can open a remote command-line interface and execute commands.(Citation: PaloAlto NanoCore Feb 2016) NanoCore uses JavaScript files.(Citation: Cofense NanoCore Mar 2018)
Suckfly	Several tools used by Suckfly have been command-line driven.(Citation: Symantec Suckfly May 2016)
GALLIUM	GALLIUM used the Windows command shell to execute commands.(Citation: Cybereason Soft Cell June 2019)
Pteranodon	Pteranodon can use `cmd.exe` for execution on victim systems.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: Symantec Shuckworm January 2022)
BLINDINGCAN	BLINDINGCAN has executed commands via cmd.exe.(Citation: US-CERT BLINDINGCAN Aug 2020)
Seasalt	Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.(Citation: Mandiant APT1 Appendix)
Magic Hound	Magic Hound has used the command-line interface.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)
PoetRAT	PoetRAT has called cmd through a Word document macro.(Citation: Talos PoetRAT October 2020)
TSCookie	TSCookie has the ability to execute shell commands on the infected host.(Citation: JPCert TSCookie March 2018)
China Chopper	China Chopper's server component is capable of opening a command terminal.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Lee 2013)(Citation: NCSC Joint Report Public Tools)
ZIRCONIUM	ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.(Citation: Zscaler APT31 Covid-19 October 2020)
Dark Caracal	Dark Caracal has used macros in Word documents that would download a second stage if executed.(Citation: Lookout Dark Caracal Jan 2018)
SQLRat	SQLRat has used SQL to execute JavaScript and VB scripts on the host system.(Citation: Flashpoint FIN 7 March 2019)
StrifeWater	StrifeWater can execute shell commands using `cmd.exe`.(Citation: Cybereason StrifeWater Feb 2022)
Wizard Spider	Wizard Spider has used cmd.exe to execute commands on a victim's machine.(Citation: DFIR Ryuk's Return October 2020)
RTM	RTM uses the command line and rundll32.exe to execute.(Citation: ESET RTM Feb 2017)
REvil	REvil can use the Windows command line to delete volume shadow copies and disable recovery.(Citation: Cylance Sodinokibi July 2019)(Citation: Talos Sodinokibi April 2019)(Citation: Picus Sodinokibi January 2020)(Citation: Secureworks REvil September 2019)
JPIN	JPIN can use the command-line utility cacls.exe to change file permissions.(Citation: Microsoft PLATINUM April 2016)
ServHelper	ServHelper can execute shell commands against cmd.(Citation: Proofpoint TA505 Jan 2019)(Citation: Deep Instinct TA505 Apr 2019)
Okrum	Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.(Citation: ESET Okrum July 2019)
Bumblebee	Bumblebee can use `cmd.exe` to drop and run files.(Citation: Google EXOTIC LILY March 2022)(Citation: Proofpoint Bumblebee April 2022)
Small Sieve	Small Sieve can use `cmd.exe` to execute commands on a victim's system.(Citation: NCSC GCHQ Small Sieve Jan 2022)
Cardinal RAT	Cardinal RAT can execute commands.(Citation: PaloAlto CardinalRat Apr 2017)
BlackMould	BlackMould can run cmd.exe with parameters.(Citation: Microsoft GALLIUM December 2019)
Taidoor	Taidoor can copy cmd.exe into the system temp folder.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
PLEAD	PLEAD has the ability to execute shell commands on the compromised host.(Citation: JPCert PLEAD Downloader June 2018)
DropBook	DropBook can execute arbitrary shell commands on the victims' machines.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
GrimAgent	GrimAgent can use the Windows Command Shell to execute commands, including its own removal.(Citation: Group IB GrimAgent July 2021)
Comnie	Comnie executes BAT scripts.(Citation: Palo Alto Comnie)
OilRig	OilRig has used macros to deliver malware such as QUADAGENT and OopsIE.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018) OilRig has used batch scripts.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018)
Threat Group-3390	Threat Group-3390 has used command-line interfaces for execution.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Unit42 Emissary Panda May 2019)
Bazar	Bazar can launch cmd.exe to perform reconnaissance commands.(Citation: Cybereason Bazar July 2020)(Citation: Zscaler Bazar September 2020)
KEYMARBLE	KEYMARBLE can execute shell commands using cmd.exe.(Citation: US-CERT KEYMARBLE Aug 2018)
Threat Group-1314	Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.(Citation: Dell TG-1314)
jRAT	jRAT has command line access.(Citation: Kaspersky Adwind Feb 2016)
Emissary	Emissary has the capability to create a remote shell and execute specified commands.(Citation: Lotus Blossom Dec 2015)
RGDoor	RGDoor uses cmd.exe to execute commands on the victim’s machine.(Citation: Unit 42 RGDoor Jan 2018)
Out1	Out1 can use native command line for execution.(Citation: Trend Micro Muddy Water March 2021)
Umbreon	Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet(Citation: Umbreon Trend Micro)
ccf32	ccf32 has used `cmd.exe` for archiving data and deleting files.(Citation: Bitdefender FunnyDream Campaign November 2020)
UPPERCUT	UPPERCUT uses cmd.exe to execute commands on the victim’s machine.(Citation: FireEye APT10 Sept 2018)
Kasidet	Kasidet can execute commands using cmd.exe.(Citation: Zscaler Kasidet)
BONDUPDATER	BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.(Citation: Palo Alto OilRig Sep 2018)
SharpStage	SharpStage can execute arbitrary commands with the command line.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
CARROTBAT	CARROTBAT has the ability to execute command line arguments on a compromised host.(Citation: Unit 42 CARROTBAT January 2020)
XTunnel	XTunnel has been used to execute remote commands.(Citation: Crowdstrike DNC June 2016)
LookBack	LookBack executes the `cmd.exe` command.(Citation: Proofpoint LookBack Malware Aug 2019)
Bandook	Bandook is capable of spawning a Windows command shell.(Citation: EFF Manul Aug 2016)(Citation: CheckPoint Bandook Nov 2020)
RATANKBA	RATANKBA uses cmd.exe to execute commands.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)
SamSam	SamSam uses custom batch scripts to execute some of its components.(Citation: Sophos SamSam Apr 2018)
Shark	Shark has the ability to use `CMD` to execute commands.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
RDAT	RDAT has executed commands using `cmd.exe /c`.(Citation: Unit42 RDAT July 2020)
More_eggs	More_eggs has used cmd.exe for execution.(Citation: Security Intelligence More Eggs Aug 2019)(Citation: ESET EvilNum July 2020)
Nomadic Octopus	Nomadic Octopus used `cmd.exe /c` within a malicious macro.(Citation: ESET Nomadic Octopus 2018)
TeamTNT	TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.(Citation: ATT TeamTNT Chimaera September 2020)
PyDCrypt	PyDCrypt has used `cmd.exe` for execution.(Citation: Checkpoint MosesStaff Nov 2021)
HTTPBrowser	HTTPBrowser is capable of spawning a reverse shell on a victim.(Citation: Dell TG-3390)
Dtrack	Dtrack has used `cmd.exe` to add a persistent service.(Citation: CyberBit Dtrack)
Machete	Machete has used batch files to initiate additional downloads of malicious files.(Citation: 360 Machete Sep 2020)
Ragnar Locker	Ragnar Locker has used cmd.exe and batch scripts to execute commands.(Citation: Sophos Ragnar May 2020)
	During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.(Citation: McAfee Night Dragon)
APT38	APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.(Citation: FireEye APT38 Oct 2018)
MuddyWater	MuddyWater has used a custom tool for creating reverse shells.(Citation: Symantec MuddyWater Dec 2018)
hcdLoader	hcdLoader provides command-line access to the compromised system.(Citation: Dell Lateral Movement)
UBoatRAT	UBoatRAT can start a command shell.(Citation: PaloAlto UBoatRAT Nov 2017)
MoleNet	MoleNet can execute commands via the command line utility.(Citation: Cybereason Molerats Dec 2020)
Tarrask	Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.(Citation: Tarrask scheduled task)
BACKSPACE	Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.(Citation: FireEye APT30)
Dragonfly 2.0	Dragonfly 2.0 used various types of scripting to perform operations, including batch scripts.(Citation: US-CERT TA18-074A)(Citation: US-CERT APT Energy Oct 2017)
Pony	Pony has used batch scripts to delete itself after execution.(Citation: Malwarebytes Pony April 2016)
AuTo Stealer	AuTo Stealer can use `cmd.exe` to execute a created batch file.(Citation: MalwareBytes SideCopy Dec 2021)
Mis-Type	Mis-Type has used `cmd.exe` to run commands on a compromised host.(Citation: Cylance Dust Storm)
BLACKCOFFEE	BLACKCOFFEE has the capability to create a reverse shell.(Citation: FireEye APT17)
APT3	An APT3 downloader uses the Windows command `"cmd.exe" /C whoami`. The group also uses a tool to execute commands on remote computers.(Citation: FireEye Operation Double Tap)(Citation: Symantec Buckeye)
Micropsia	Micropsia creates a command-line shell using cmd.exe.(Citation: Radware Micropsia July 2018)
4H RAT	4H RAT has the capability to create a remote shell.(Citation: CrowdStrike Putter Panda)
SYSCON	SYSCON has the ability to execute commands through cmd on a compromised host.(Citation: Unit 42 CARROTBAT January 2020)
PcShare	PcShare can execute `cmd` commands on a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
SLOTHFULMEDIA	SLOTHFULMEDIA can open a command line to execute commands.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
APT32	APT32 has used cmd.exe for execution.(Citation: Cybereason Cobalt Kitty 2017)
Remexi	Remexi silently executes received commands with cmd.exe.(Citation: Securelist Remexi Jan 2019)
RunningRAT	RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.(Citation: McAfee Gold Dragon)
H1N1	H1N1 kills and disables services by using cmd.exe.(Citation: Cisco H1N1 Part 2)
FIN10	FIN10 has executed malicious .bat files containing PowerShell commands.(Citation: FireEye FIN10 June 2017)
MCMD	MCMD can launch a console process (cmd.exe) with redirected standard input and output.(Citation: Secureworks MCMD July 2019)
MarkiRAT	MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.(Citation: Kaspersky Ferocious Kitten Jun 2021)
Peppy	Peppy has the ability to execute shell commands.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Cuba	Cuba has used `cmd.exe /c` and batch files for execution.(Citation: McAfee Cuba April 2021)
Gorgon Group	Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.(Citation: Unit 42 Gorgon Group Aug 2018)
FIN6	FIN6 has used `kill.bat` script to disable security tools.(Citation: FireEye FIN6 Apr 2019)
Saint Bot	Saint Bot has used `cmd.exe` and `.bat` scripts for execution.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Spark	Spark can use cmd.exe to run commands.(Citation: Unit42 Molerat Mar 2020)
Cobian RAT	Cobian RAT can launch a remote command shell interface for executing commands.(Citation: Zscaler Cobian Aug 2017)
Carbanak	Carbanak has a command to create a reverse shell.(Citation: FireEye CARBANAK June 2017)
Fox Kitten	Fox Kitten has used cmd.exe likely as a password changing mechanism.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
Blue Mockingbird	Blue Mockingbird has used batch script files to automate execution and deployment of payloads.(Citation: RedCanary Mockingbird May 2020)
AuditCred	AuditCred can open a reverse shell on the system to execute commands.(Citation: TrendMicro Lazarus Nov 2018)
SideTwist	SideTwist can execute shell commands on a compromised host.(Citation: Check Point APT34 April 2021)
Sandworm Team	Sandworm Team has run the `xp_cmdshell` command in MS-SQL.(Citation: Dragos Crashoverride 2018)
APT28	An APT28 loader Trojan uses a cmd.exe and batch script to run its payload.(Citation: Unit 42 Playbook Dec 2017) The group has also used macros to execute payloads.(Citation: Talos Seduploader Oct 2017)(Citation: Unit42 Cannon Nov 2018)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: TrendMicro Pawn Storm Dec 2020)
Honeybee	Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.(Citation: McAfee Honeybee) Honeybee used batch scripting.(Citation: McAfee Honeybee)
Ryuk	Ryuk has used `cmd.exe` to create a Registry entry to establish persistence.(Citation: CrowdStrike Ryuk January 2019)
TinyTurla	TinyTurla has been installed using a .bat file.(Citation: Talos TinyTurla September 2021)
KGH_SPY	KGH_SPY has the ability to set a Registry key to run a cmd.exe command.(Citation: Cybereason Kimsuky November 2020)
MURKYTOP	MURKYTOP uses the command-line interface.(Citation: FireEye Periscope March 2018)
S-Type	S-Type has provided the ability to execute shell commands on a compromised host.(Citation: Cylance Dust Storm)
Wiarp	Wiarp creates a backdoor through which remote attackers can open a command line interface.(Citation: Symantec Wiarp May 2012)
Kimsuky	Kimsuky has executed Windows commands by using `cmd` and running batch scripts.(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)
Netwalker	Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.(Citation: Sophos Netwalker May 2020)
Caterpillar WebShell	Caterpillar WebShell can run commands on the compromised asset with CMD functions.(Citation: ClearSky Lebanese Cedar Jan 2021)
KOCTOPUS	KOCTOPUS has used `cmd.exe` and batch files for execution.(Citation: MalwareBytes LazyScripter Feb 2021)
Flagpro	Flagpro can use `cmd.exe` to execute commands received from C2.(Citation: NTT Security Flagpro new December 2021)
Lokibot	Lokibot has used `cmd /c` commands embedded within batch scripts.(Citation: Talos Lokibot Jan 2021)
Hikit	Hikit has the ability to create a remote shell and run given commands.(Citation: FireEye HIKIT Rootkit Part 2)
MoonWind	MoonWind can execute commands via an interactive command shell.(Citation: Palo Alto MoonWind March 2017) MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.(Citation: Palo Alto MoonWind March 2017)
Mustang Panda	Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Avira Mustang Panda January 2020)
Dipsind	Dipsind can spawn remote shells.(Citation: Microsoft PLATINUM April 2016)
ECCENTRICBANDWAGON	ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.(Citation: CISA EB Aug 2020)
HOPLIGHT	HOPLIGHT can launch cmd.exe to execute commands on the system.(Citation: US-CERT HOPLIGHT Apr 2019)
ADVSTORESHELL	ADVSTORESHELL can create a remote shell and run a given command.(Citation: ESET Sednit Part 2)(Citation: Bitdefender APT28 Dec 2015)
Tropic Trooper	Tropic Trooper has used Windows command scripts.(Citation: TrendMicro Tropic Trooper May 2020)
SEASHARPEE	SEASHARPEE can execute commands on victims.(Citation: FireEye APT34 Webinar Dec 2017)
WastedLocker	WastedLocker has used cmd to execute commands on the system.(Citation: NCC Group WastedLocker June 2020)
TURNEDUP	TURNEDUP is capable of creating a reverse shell.(Citation: FireEye APT33 Sept 2017)
Linfo	Linfo creates a backdoor through which remote attackers can start a remote shell.(Citation: Symantec Linfo May 2012)
PlugX	PlugX allows actors to spawn a reverse shell on a victim.(Citation: Dell TG-3390)(Citation: CIRCL PlugX March 2013)
DnsSystem	DnsSystem can use `cmd.exe` for execution.(Citation: Zscaler Lyceum DnsSystem June 2022)
BBK	BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.(Citation: Trend Micro Tick November 2019)
GoldenSpy	GoldenSpy can execute remote commands via the command-line interface.(Citation: Trustwave GoldenSpy June 2020)
Goopy	Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.(Citation: Cybereason Cobalt Kitty 2017)
OopsIE	OopsIE uses the command prompt to execute commands on the victim's machine.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)
MechaFlounder	MechaFlounder has the ability to run commands on a compromised host.(Citation: Unit 42 MechaFlounder March 2019)
QUADAGENT	QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.(Citation: Unit 42 QUADAGENT July 2018)
APT41	APT41 used `cmd.exe /c` to execute commands on remote machines.(Citation: FireEye APT41 Aug 2019) APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.(Citation: FireEye APT41 March 2020)
Babuk	Babuk has the ability to use the command line to control execution on compromised hosts.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)
	During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.(Citation: McAfee Honeybee)
ShimRat	ShimRat can be issued a command shell function from the C2.(Citation: FOX-IT May 2016 Mofang)
NETEAGLE	NETEAGLE allows adversaries to execute shell commands on the infected host.(Citation: FireEye APT30)
HARDRAIN	HARDRAIN uses cmd.exe to execute `netsh`commands.(Citation: US-CERT HARDRAIN March 2018)
Koadic	Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.(Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)
TAINTEDSCRIBE	TAINTEDSCRIBE can enable Windows CLI access and execute files.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
HermeticWiper	HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.(Citation: ESET Hermetic Wizard March 2022)
	During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.(Citation: Bitdefender FunnyDream Campaign November 2020)
Clambling	Clambling can use cmd.exe for command execution.(Citation: Trend Micro DRBControl February 2020)
	During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line (Citation: Talos Frankenstein June 2019)
Indrik Spider	Indrik Spider has used batch scripts on victim's machines.(Citation: Crowdstrike Indrik November 2018)
RogueRobin	RogueRobin uses Windows Script Components.(Citation: Unit42 DarkHydrus Jan 2019)(Citation: Unit 42 DarkHydrus July 2018)
DarkWatchman	DarkWatchman can use `cmd.exe` to execute commands.(Citation: Prevailion DarkWatchman 2021)
Aquatic Panda	Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to `cmd /C`.(Citation: CrowdStrike AQUATIC PANDA December 2021)
EvilBunny	EvilBunny has an integrated scripting engine to download and execute Lua scripts.(Citation: Cyphort EvilBunny Dec 2014)
EnvyScout	EnvyScout can use cmd.exe to execute malicious files on compromised hosts.(Citation: MSTIC Nobelium Toolset May 2021)
JHUHUGIT	JHUHUGIT uses a .bat file to execute a .dll.(Citation: Talos Seduploader Oct 2017)
USBferry	USBferry can execute various Windows commands.(Citation: TrendMicro Tropic Trooper May 2020)
Remcos	Remcos can launch a remote command line to execute commands on the victim’s machine.(Citation: Fortinet Remcos Feb 2017)
WellMess	WellMess can execute command line scripts received from C2.(Citation: PWC WellMess July 2020)
RedLeaves	RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)
LightNeuron	LightNeuron is capable of executing commands via cmd.exe.(Citation: ESET LightNeuron May 2019)
InvisiMole	InvisiMole can launch a remote shell to execute commands.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Milan	Milan can use `cmd.exe` for discovery actions on a targeted system.(Citation: ClearSky Siamesekitten August 2021)
DarkComet	DarkComet can launch a remote shell to execute commands on the victim’s machine.(Citation: Malwarebytes DarkComet March 2018)
PoisonIvy	PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.(Citation: Symantec Darkmoon Aug 2005)
RainyDay	RainyDay can use the Windows Command Shell for execution.(Citation: Bitdefender Naikon April 2021)
ComRAT	ComRAT has used `cmd.exe` to execute commands.(Citation: ESET ComRAT May 2020)
GoldMax	GoldMax can spawn a command shell, and execute native commands.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
Turla	Turla RPC backdoors have used cmd.exe to execute commands.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)
ZLib	ZLib has the ability to execute shell commands.(Citation: Cylance Dust Storm)
HotCroissant	HotCroissant can remotely open applications on the infected host with the `ShellExecuteA` command.(Citation: Carbon Black HotCroissant April 2020)
MegaCortex	MegaCortex has used `.cmd` scripts on the victim's system.(Citation: IBM MegaCortex)
Siloscape	Siloscape can run cmd through an IRC channel.(Citation: Unit 42 Siloscape Jun 2021)
Chimera	Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.(Citation: NCC Group Chimera January 2021)
GreyEnergy	GreyEnergy uses cmd.exe to execute itself in-memory.(Citation: ESET GreyEnergy Oct 2018)
Volgmer	Volgmer can execute commands on the victim's machine.(Citation: US-CERT Volgmer Nov 2017)(Citation: US-CERT Volgmer 2 Nov 2017)
Sowbug	Sowbug has used command line during its intrusions.(Citation: Symantec Sowbug Nov 2017)
TrickBot	TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.(Citation: TrendMicro Trickbot Feb 2019)
Cobalt Group	Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.(Citation: Morphisec Cobalt Gang Oct 2018) The group has used an exploit toolkit known as Threadkit that launches .bat files.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: Group IB Cobalt Aug 2017)(Citation: Morphisec Cobalt Gang Oct 2018)(Citation: Unit 42 Cobalt Gang Oct 2018)(Citation: TrendMicro Cobalt Group Nov 2017)
Frankenstein	Frankenstein has run a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line.(Citation: Talos Frankenstein June 2019)
Clop	Clop can use cmd.exe to help execute commands on the system.(Citation: Cybereason Clop Dec 2020)
NavRAT	NavRAT leverages cmd.exe to perform discovery techniques.(Citation: Talos NavRAT May 2018) NavRAT loads malicious shellcode and executes it in memory.(Citation: Talos NavRAT May 2018)
BADNEWS	BADNEWS is capable of executing commands via cmd.exe.(Citation: Forcepoint Monsoon)(Citation: TrendMicro Patchwork Dec 2017)
HiddenWasp	HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.(Citation: Intezer HiddenWasp Map 2019)
ZxShell	ZxShell can launch a reverse command shell.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014)(Citation: Secureworks BRONZEUNION Feb 2019)
Kevin	Kevin can use a renamed image of `cmd.exe` for execution.(Citation: Kaspersky Lyceum October 2021)
Sakula	Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.(Citation: Dell Sakula)
DealersChoice	DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.(Citation: Sofacy DealersChoice)
SUGARUSH	SUGARUSH has used `cmd` for execution on an infected host.(Citation: Mandiant UNC3890 Aug 2022)
Cobalt Strike	Cobalt Strike uses a command-line interface to interact with systems.(Citation: Cobalt Strike TTPs Dec 2017)
Maze	The Maze encryption process has used batch scripts with various commands.(Citation: FireEye Maze May 2020)(Citation: Sophos Maze VM September 2020)
DanBot	DanBot has the ability to execute arbitrary commands via `cmd.exe`.(Citation: SecureWorks August 2019)(Citation: ClearSky Siamesekitten August 2021)
POWRUNER	POWRUNER can execute commands from its C2 server.(Citation: FireEye APT34 Dec 2017)
Hi-Zor	Hi-Zor has the ability to create a reverse shell.(Citation: Fidelis INOCNATION)
WhisperGate	WhisperGate can use `cmd.exe` to execute commands.(Citation: Unit 42 WhisperGate January 2022)
Empire	Empire has modules for executing scripts.(Citation: Github PowerShell Empire)
CharmPower	The C# implementation of the CharmPower command execution module can use `cmd`.(Citation: Check Point APT35 CharmPower January 2022)
Helminth	Helminth can provide a remote shell. One version of Helminth uses batch scripting.(Citation: Palo Alto OilRig May 2016)
NETWIRE	NETWIRE can issue commands using cmd.exe.(Citation: Red Canary NETWIRE January 2020)(Citation: Proofpoint NETWIRE December 2020)
httpclient	httpclient opens cmd.exe on the victim.(Citation: CrowdStrike Putter Panda)
KONNI	KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.(Citation: Talos Konni May 2017)(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)
Revenge RAT	Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.(Citation: Cofense RevengeRAT Feb 2019)
QuasarRAT	QuasarRAT can launch a remote shell to execute commands on the victim’s machine.(Citation: GitHub QuasarRAT)(Citation: CISA AR18-352A Quasar RAT December 2018)
JCry	JCry has used `cmd.exe` to launch PowerShell.(Citation: Carbon Black JCry May 2019)
	During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)
HAWKBALL	HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.(Citation: FireEye HAWKBALL Jun 2019)
WEBC2	WEBC2 can open an interactive command shell.(Citation: Mandiant APT1)
Leviathan	Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell, and has used multiple types of scripting for execution, including JavaScript and JavaScript Scriptlets in XML.(Citation: Proofpoint Leviathan Oct 2017).(Citation: FireEye Periscope March 2018)
Misdat	Misdat is capable of providing shell functionality to the attacker to execute commands.(Citation: Cylance Dust Storm)
GravityRAT	GravityRAT executes commands remotely on the infected host.(Citation: Talos GravityRAT)
	During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.(Citation: DFIR Conti Bazar Nov 2021)
UNC2452	UNC2452 used `cmd.exe` to execute commands on remote machines.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)
Zebrocy	Zebrocy uses cmd.exe to execute commands on the system.(Citation: ESET Zebrocy May 2019)(Citation: CISA Zebrocy Oct 2020)
Exaramel for Windows	Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.(Citation: ESET TeleBots Oct 2018)
Dragonfly	Dragonfly has used various types of scripting to perform operations, including batch scripts.(Citation: US-CERT TA18-074A)
TEXTMATE	TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.(Citation: FireEye FIN7 March 2017)(Citation: Cisco DNSMessenger March 2017)
LazyScripter	LazyScripter has used batch files to deploy open-source and multi-stage RATs.(Citation: MalwareBytes LazyScripter Feb 2021)
xCaon	xCaon has a command to start an interactive shell.(Citation: Checkpoint IndigoZebra July 2021)
Gold Dragon	Gold Dragon uses cmd.exe to execute commands for discovery.(Citation: McAfee Gold Dragon)
Lucifer	Lucifer can issue shell commands to download and execute additional payloads.(Citation: Unit 42 Lucifer June 2020)
Nebulae	Nebulae can use CMD to execute a process.(Citation: Bitdefender Naikon April 2021)
Rising Sun	Rising Sun has executed commands using `cmd.exe /c “ > <%temp%>\AM. tmp” 2>&1`.(Citation: McAfee Sharpshooter December 2018)
Chaes	Chaes has used cmd to execute tasks on the system.(Citation: Cybereason Chaes Nov 2020)
CoinTicker	CoinTicker executes a bash script to establish a reverse shell.(Citation: CoinTicker 2019)
Darkhotel	Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.(Citation: Securelist Darkhotel Aug 2015)
Mosquito	Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.(Citation: ESET Turla Mosquito Jan 2018)
Patchwork	Patchwork ran a reverse shell with Meterpreter.(Citation: Cymmetria Patchwork) Patchwork used JavaScript code and .SCT files on victim machines.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)
MirageFox	MirageFox has the capability to execute commands using cmd.exe.(Citation: APT15 Intezer June 2018)
Metamorfo	Metamorfo has used `cmd.exe /c` to execute files.(Citation: Medium Metamorfo Apr 2020)
Meteor	Meteor can run `set.bat`, `update.bat`, `cache.bat`, `bcd.bat`, `msrun.bat`, and similar scripts.(Citation: Check Point Meteor Aug 2021)
Bankshot	Bankshot uses the command-line interface to execute arbitrary commands.(Citation: McAfee Bankshot)(Citation: US-CERT Bankshot Dec 2017)
Emotet	Emotet has used cmd.exe to run a PowerShell script. (Citation: Picus Emotet Dec 2018)
Bisonal	Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
APT37	APT37 has used the command-line interface.(Citation: FireEye APT37 Feb 2018)(Citation: Talos Group123)
Crimson	Crimson has the ability to execute commands with the COMSPEC environment variable.(Citation: Kaspersky Transparent Tribe August 2020)
Zeus Panda	Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.(Citation: GDATA Zeus Panda June 2017)
FIN7	FIN7 used the command prompt to launch commands on the victim’s machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)
PingPull	PingPull can use `cmd.exe` to run various commands as a reverse shell.(Citation: Unit 42 PingPull Jun 2022)
WarzoneRAT	WarzoneRAT can use `cmd.exe` to execute malicious code.(Citation: Check Point Warzone Feb 2020)
Ke3chang	Ke3chang has used batch scripts in its malware to install persistence mechanisms.(Citation: NCC Group APT15 Alive and Strong)
TDTESS	TDTESS provides a reverse shell on the victim.(Citation: ClearSky Wilted Tulip July 2017)
SILENTTRINITY	SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.(Citation: GitHub SILENTTRINITY Modules July 2019)
STARWHALE	STARWHALE has the ability to execute commands via `cmd.exe`.(Citation: Mandiant UNC3313 Feb 2022)
Gelsemium	Gelsemium can use a batch script to delete itself.(Citation: ESET Gelsemium June 2021)
BRONZE BUTLER	BRONZE BUTLER has used batch scripts and the command-line interface for execution.(Citation: Secureworks BRONZE BUTLER Oct 2017)
Ember Bear	Ember Bear had used `cmd.exe` and Windows Script Host (wscript) to execute malicious code.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Turian	Turian can create a remote shell and execute commands using cmd.(Citation: ESET BackdoorDiplomacy Jun 2021)
adbupd	adbupd can run a copy of cmd.exe.(Citation: Microsoft PLATINUM April 2016)
Higaisa	Higaisa used `cmd.exe` for execution.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)
zwShell	zwShell can launch command-line shells.(Citation: McAfee Night Dragon)
TYPEFRAME	TYPEFRAME can uninstall malware components using a batch script.(Citation: US-CERT TYPEFRAME June 2018) TYPEFRAME can execute commands using a shell.(Citation: US-CERT TYPEFRAME June 2018)
menuPass	menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.(Citation: PWC Cloud Hopper April 2017)(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Github AD-Pentest-Script)(Citation: FireEye APT10 Sept 2018) menuPass has used malicious macros embedded inside Office documents to execute files.(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)
Trojan.Karagany	Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.(Citation: Secureworks Karagany July 2019)
Proxysvc	Proxysvc executes a binary on the system and logs the results into a temp file by using: `cmd.exe /c " > %temp%\PM* .tmp 2>&1"`.(Citation: McAfee GhostSecret)
FIN8	FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016) FIN8 has also executed commands remotely via cmd.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)
SNUGRIDE	SNUGRIDE is capable of executing commands and spawning a reverse shell.(Citation: FireEye APT10 April 2017)
Squirrelwaffle	Squirrelwaffle has used `cmd.exe` for execution.(Citation: Netskope Squirrelwaffle Oct 2021)
LoudMiner	LoudMiner used a batch script to run the Linux virtual machine as a service.(Citation: ESET LoudMiner June 2019)
APT18	APT18 uses cmd.exe to execute commands on the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)(Citation: Anomali Evasive Maneuvers July 2015)
PowerDuke	PowerDuke runs `cmd.exe /c` and sends the output to its C2.(Citation: Volexity PowerDuke November 2016)
KeyBoy	KeyBoy can launch interactive shells for communicating with the victim machine.(Citation: PWC KeyBoys Feb 2017)(Citation: Rapid7 KeyBoy Jun 2013)
Egregor	Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.(Citation: JoeSecurity Egregor 2020)(Citation: Cybereason Egregor Nov 2020)
TA551	TA551 has used `cmd.exe` to execute commands.(Citation: Unit 42 TA551 Jan 2021)
RobbinHood	RobbinHood uses cmd.exe on the victim's computer.(Citation: CarbonBlack RobbinHood May 2019)
Conti	Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.(Citation: CarbonBlack Conti July 2020)(Citation: DFIR Conti Bazar Nov 2021)
FELIXROOT	FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)
Rancor	Rancor has used cmd.exe to execute commmands.(Citation: Rancor Unit42 June 2018)
APT1	APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.(Citation: Mandiant APT1)
PLAINTEE	PLAINTEE uses cmd.exe to execute commands on the victim’s machine.(Citation: Rancor Unit42 June 2018)
FunnyDream	FunnyDream can use `cmd.exe` for execution on remote hosts.(Citation: Bitdefender FunnyDream Campaign November 2020)
Ixeshe	Ixeshe is capable of executing commands via cmd.(Citation: Trend Micro IXESHE 2012)
PHOREAL	PHOREAL is capable of creating reverse shell.(Citation: FireEye APT32 May 2017)
Operation Wocao	Operation Wocao has spawned a new `cmd.exe` process to execute commands.(Citation: FoxIT Wocao December 2019)
ABK	ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.(Citation: Trend Micro Tick November 2019)
DownPaper	DownPaper uses the command line.(Citation: ClearSky Charming Kitten Dec 2017)
SDBbot	SDBbot has the ability to use the command shell to execute commands on a compromised host.(Citation: Proofpoint TA505 October 2019)
Astaroth	Astaroth spawns a CMD process to execute commands. (Citation: Cybereason Astaroth Feb 2019)
Silence	Silence has used Windows command-line to run commands.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)
KOMPROGO	KOMPROGO is capable of creating a reverse shell.(Citation: FireEye APT32 May 2017)
BISCUIT	BISCUIT has a command to launch a command shell on the system.(Citation: Mandiant APT1 Appendix)
Gamaredon Group	Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Unit 42 Gamaredon February 2022)
Mivast	Mivast has the capability to open a remote shell and run basic commands.(Citation: Symantec Backdoor.Mivast)
Denis	Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
StreamEx	StreamEx has the ability to remotely execute commands.(Citation: Cylance Shell Crew Feb 2017)
njRAT	njRAT can launch a command shell interface for executing commands.(Citation: Fidelis njRAT June 2013)
cmd	cmd is used to execute programs and other actions at the command-line interface.(Citation: TechNet Cmd)
RCSession	RCSession can use `cmd.exe` for execution on compromised hosts.(Citation: Trend Micro DRBControl February 2020)
admin@338	Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.(Citation: FireEye admin@338)
HOMEFRY	HOMEFRY uses a command-line interface.(Citation: FireEye Periscope March 2018)
Cobalt Strike	Cobalt Strike uses a command-line interface to interact with systems.(Citation: Cobalt Strike TTPs Dec 2017)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
BabyShark	BabyShark has used cmd.exe to execute commands.(Citation: Unit42 BabyShark Feb 2019)
Kazuar	Kazuar uses cmd.exe to execute commands on the victim’s machine.(Citation: Unit 42 Kazuar May 2017)
TinyZBot	TinyZBot supports execution from the command-line.(Citation: Cylance Cleaver)
Felismus	Felismus uses command line for execution.(Citation: Forcepoint Felismus Mar 2017)
Action RAT	Action RAT can use `cmd.exe` to execute commands on an infected host.(Citation: MalwareBytes SideCopy Dec 2021)
TA505	TA505 has executed commands using `cmd.exe`.(Citation: Trend Micro TA505 June 2019)

Контрмера	Описание
Контрмеры
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.

Обнаружение

Usage of the Windows command shell may be common on administrator, developer, or power user systems depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.