Description
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.(Citation: SSH in Windows)
Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.
Reverse Shell Cheatsheet
Read our in-depth pentesting guide related to this technique
Platforms
Mitigations (1)
Execution PreventionM1038
Use application control where appropriate.
Threat Groups (73)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.(Citatio... |
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has used batch scripts on victim's machines.(Citation: Crowdstrike Indrik November 2018)(Citati... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) executed ransomware using the Windows command shell.(Citation: FBI BlackByte 2022) |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) used the Windows command shell to execute commands.(Citation: Cybereason Soft Cell June 2019) |
| G0022 | APT3 | An [APT3](https://attack.mitre.org/groups/G0022) downloader uses the Windows command <code>"cmd.exe" /C whoami</code>. The group also uses a tool to e... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has executed Windows commands by using `cmd` and running batch scripts.(Citation: Talos Kimsuky Nov 2... |
| G1037 | TA577 | [TA577](https://attack.mitre.org/groups/G1037) has used BAT files in malware execution chains.(Citation: Latrodectus APR 2024) |
| G0018 | admin@338 | Following exploitation with [LOWBALL](https://attack.mitre.org/software/S0042) malware, [admin@338](https://attack.mitre.org/groups/G0018) actors crea... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used the Windows command line to perform hands-on-keyboard activities in targeted environmen... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) ran a reverse shell with Meterpreter.(Citation: Cymmetria Patchwork) [Patchwork](https://attack.mit... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used <code>cmd.exe /c</code> to execute commands on remote machines.(Citation: FireEye APT41 Aug 2019) ... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has used various types of scripting to perform operations, including batch scripts.(Citation: US-CE... |
| G0078 | Gorgon Group | [Gorgon Group](https://attack.mitre.org/groups/G0078) malware can use cmd.exe to download and execute payloads and to execute commands on the system.(... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) executes commands using a command-line interface and reverse shell. The group has used a modified ve... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has used cmd.exe for execution.(Citation: Cybereason Cobalt Kitty 2017) |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has used `cmd.exe` to execute commands on the victim's machine.(Citation: Rapid7 HAFNIUM Mar 2021) |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used a custom tool for creating reverse shells.(Citation: Symantec MuddyWater Dec 2018) |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) has used <code>kill.bat</code> script to disable security tools.(Citation: FireEye FIN6 Apr 2019) |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used various batch scripts to establish C2 and download additional files. [Gamaredon Grou... |
| G1046 | Storm-1811 | [Storm-1811](https://attack.mitre.org/groups/G1046) has used multiple batch scripts during initial access and subsequent actions on victim machines.(C... |
Associated Software (295)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) has used macros in Excel documents to download and deploy the malware on the user’s machine.(Citat... |
| S0139 | PowerDuke | Malware | [PowerDuke](https://attack.mitre.org/software/S0139) runs <code>cmd.exe /c</code> and sends the output to its C2.(Citation: Volexity PowerDuke Novembe... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has executed commands via cmd.exe.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| S1145 | Pikabot | Malware | [Pikabot](https://attack.mitre.org/software/S1145) can execute Windows shell commands via <code>cmd.exe</code>.(Citation: Zscaler Pikabot 2023) |
| S0206 | Wiarp | Malware | [Wiarp](https://attack.mitre.org/software/S0206) creates a backdoor through which remote attackers can open a command line interface.(Citation: Symant... |
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) can use `cmd.exe` for execution on compromised hosts.(Citation: Trend Micro DRBControl February 2... |
| S0543 | Spark | Malware | [Spark](https://attack.mitre.org/software/S0543) can use cmd.exe to run commands.(Citation: Unit42 Molerat Mar 2020) |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can use `cmd.exe` to drop and run files.(Citation: Google EXOTIC LILY March 2022)(Citation: Proof... |
| S0233 | MURKYTOP | Malware | [MURKYTOP](https://attack.mitre.org/software/S0233) uses the command-line interface.(Citation: FireEye Periscope March 2018) |
| S0343 | Exaramel for Windows | Malware | [Exaramel for Windows](https://attack.mitre.org/software/S0343) has a command to launch a remote shell and executes commands on the victim’s machine.(... |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) executes a binary on the system and logs the results into a temp file by using: <code>cmd.exe /c "... |
| S0229 | Orz | Malware | [Orz](https://attack.mitre.org/software/S0229) can execute shell commands.(Citation: Proofpoint Leviathan Oct 2017) [Orz](https://attack.mitre.org/sof... |
| S9029 | IronWind | Malware | [IronWind](https://attack.mitre.org/software/S9029) has used the Windows command shell to execute malicious files.(Citation: Check Point Wirte NOV 202... |
| S0185 | SEASHARPEE | Malware | [SEASHARPEE](https://attack.mitre.org/software/S0185) can execute commands on victims.(Citation: FireEye APT34 Webinar Dec 2017) |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) can execute commands from its C2 server.(Citation: FireEye APT34 Dec 2017) |
| S0400 | RobbinHood | Malware | [RobbinHood](https://attack.mitre.org/software/S0400) uses cmd.exe on the victim's computer.(Citation: CarbonBlack RobbinHood May 2019) |
| S0164 | TDTESS | Malware | [TDTESS](https://attack.mitre.org/software/S0164) provides a reverse shell on the victim.(Citation: ClearSky Wilted Tulip July 2017) |
| S0546 | SharpStage | Malware | [SharpStage](https://attack.mitre.org/software/S0546) can execute arbitrary commands with the command line.(Citation: Cybereason Molerats Dec 2020)(Ci... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to run `cmd.exe` or other interactive processes on a compromised computer.(Citatio... |
| S0083 | Misdat | Malware | [Misdat](https://attack.mitre.org/software/S0083) is capable of providing shell functionality to the attacker to execute commands.(Citation: Cylance D... |
Related CWE Weaknesses
References
Frequently Asked Questions
What is T1059.003 (Windows Command Shell)?
T1059.003 is a MITRE ATT&CK technique named 'Windows Command Shell'. It belongs to the Execution tactic(s). Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows...
How can T1059.003 be detected?
Detection of T1059.003 (Windows Command Shell) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1059.003?
There are 1 documented mitigations for T1059.003. Key mitigations include: Execution Prevention.
Which threat groups use T1059.003?
Known threat groups using T1059.003 include: APT38, Indrik Spider, BlackByte, GALLIUM, APT3, Kimsuky, TA577, admin@338.