value:  APT18 uses cmd.exe to execute commands on the victim’s machine. ;; An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads. ;; APT29 used cmd.exe to execute commands on remote machines. ;; An APT3 downloader uses the Windows command cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers. ;; APT32 has used cmd.exe for execution. ;; APT37 has used the command-line interface. ;; APT38 has used a command-line tunneler NACHOCHEESE to give them shell access to a victim’s machine. ;; APT41 used cmd.exe /c to execute commands on remote machines.APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader. ;; Astaroth spawns a CMD process to execute commands. ;; AuditCred can open a reverse shell on the system to execute commands. ;; BabyShark has used cmd.exe to execute commands. ;; BackConfig can download and run batch files to execute commands on a compromised host. ;; Adversaries can direct BACKSPACE to execute from the command line on infected hosts or have BACKSPACE create a reverse shell. ;; BADNEWS is capable of executing commands via cmd.exe. ;; Bandook is capable of spawning a Windows command shell. ;; Bankshot uses the command-line interface to execute arbitrary commands. ;; Bazar can launch cmd.exe to perform reconnaissance commands. ;; BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host. ;; BISCUIT has a command to launch a command shell on the system. ;; Bisonal can launch cmd.exe to execute commands on the system. ;; BLACKCOFFEE has the capability to create a reverse shell. ;; BlackMould can run cmd.exe with parameters. ;; BLINDINGCAN has executed commands via cmd.exe. ;; Blue Mockingbird has used batch script files to automate execution and deployment of payloads. ;; BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe. ;; BRONZE BUTLER has used batch scripts and the command-line interface for execution. ;; CALENDAR has a command to run cmd.exe to execute commands. ;; Carbanak has a command to create a reverse shell. ;; Cardinal RAT can execute commands. ;; CARROTBAT has the ability to execute command line arguments on a compromised host. ;; Caterpillar WebShell can run commands on the compromised asset with CMD functions. ;; Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts. ;; China Chopper's server component is capable of opening a command terminal. ;; cmd is used to execute programs and other actions at the command-line interface. ;; Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files. ;; Cobalt Strike uses a command-line interface to interact with systems. ;; Cobian RAT can launch a remote command shell interface for executing commands. ;; CoinTicker executes a bash script to establish a reverse shell. ;; Comnie executes BAT scripts. ;; ComRAT has used cmd.exe to execute commands. ;; Conti can utilize command line options to allow an attacker control over how it scans and encrypts files. ;; A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe. ;; Dark Caracal has used macros in Word documents that would download a second stage if executed. ;; DarkComet can launch a remote shell to execute commands on the victim’s machine. ;; Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file. ;; Daserf can execute shell commands. ;; DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine. ;; Denis can launch a remote shell to execute arbitrary commands on the victim’s machine. ;; Dipsind can spawn remote shells. ;; DownPaper uses the command line. ;; Dragonfly 2.0 used various types of scripting to perform operations including batch scripts. ;; DropBook can execute arbitrary shell commands on the victims' machines. ;; Dtrack has used cmd.exe to add a persistent service. ;; ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine. ;; Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe. ;; Emissary has the capability to create a remote shell and execute specified commands. ;; Emotet has used cmd.exe to run a PowerShell script. ;; Empire has modules for executing scripts. ;; EvilBunny has an integrated scripting engine to download and execute Lua scripts. ;; Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine. ;; Felismus uses command line for execution. ;; FELIXROOT executes batch scripts on the victim’s machine and can launch a reverse shell for command execution. ;; FIN10 has executed malicious .bat files containing PowerShell commands. ;; FIN6 has used kill.bat script to disable security tools. ;; FIN7 used the command prompt to launch commands on the victim’s machine. ;; FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 executes commands remotely via cmd.exe. ;; Fox Kitten has used cmd.exe likely as a password changing mechanism. ;; Frankenstein has run a command script to set up persistence as a scheduled task named "WinUpdate" as well as other encoded commands from the command-line. ;; GALLIUM used the Windows command shell to execute commands. ;; Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file. ;; Gold Dragon uses cmd.exe to execute commands for discovery. ;; GoldenSpy can execute remote commands via the command-line interface. ;; GoldMax can spawn a command shell and execute native commands. ;; Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel. ;; Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system. ;; GravityRAT executes commands remotely on the infected host. ;; GreyEnergy uses cmd.exe to execute itself in-memory. ;; H1N1 kills and disables services by using cmd.exe. ;; HARDRAIN uses cmd.exe to execute netshcommands. ;; HAWKBALL has created a cmd.exe reverse shell executed commands and uploaded output via the command line. ;; hcdLoader provides command-line access to the compromised system. ;; Helminth can provide a remote shell. One version of Helminth uses batch scripting. ;; Hi-Zor has the ability to create a reverse shell. ;; HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution. ;; Higaisa used cmd.exe for execution. ;; Hikit has the ability to create a remote shell and run given commands. ;; HOMEFRY uses a command-line interface. ;; Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint. Honeybee used batch scripting. ;; HOPLIGHT can launch cmd.exe to execute commands on the system. ;; HotCroissant can remotely open applications on the infected host with the ShellExecuteA command. ;; HTTPBrowser is capable of spawning a reverse shell on a victim. ;; httpclient opens cmd.exe on the victim. ;; Indrik Spider has used batch scripts on victim's machines. ;; InnaputRAT launches a shell to execute commands on the victim’s machine. ;; InvisiMole can launch a remote shell to execute commands. ;; Ixeshe is capable of executing commands via cmd. ;; JCry has used cmd.exe to launch PowerShell. ;; JHUHUGIT uses a .bat file to execute a .dll. ;; JPIN can use the command-line utility cacls.exe to change file permissions. ;; jRAT has command line access. ;; Kasidet can execute commands using cmd.exe. ;; Kazuar uses cmd.exe to execute commands on the victim’s machine. ;; Ke3chang has used batch scripts in its malware to install persistence mechanisms. ;; KeyBoy can launch interactive shells for communicating with the victim machine. ;; KEYMARBLE can execute shell commands using cmd.exe. ;; KGH_SPY has the ability to set a Registry key to run a cmd.exe command. ;; Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and runs arbitrary shellcode . ;; KOMPROGO is capable of creating a reverse shell. ;; KONNI has used cmd.exe execute arbitrary commands on the infected host across different stages of the infection change. ;; Lazarus Group malware uses cmd.exe to execute commands on victims. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system. ;; Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell and has used multiple types of scripting for execution including JavaScript and JavaScript Scriptlets in XML.. ;; LightNeuron is capable of executing commands via cmd.exe. ;; Linfo creates a backdoor through which remote attackers can start a remote shell. ;; LookBack executes the cmd.exe command. ;; LoudMiner used a batch script to run the Linux virtual machine as a service. ;; Lucifer can issue shell commands to download and execute additional payloads. ;; Machete has used batch files to initiate additional downloads of malicious files. ;; Magic Hound has used the command-line interface. ;; The Maze encryption process has used batch scripts with various commands. ;; MCMD can launch a console process (cmd.exe) with redirected standard input and output. ;; MechaFlounder has the ability to run commands on a compromised host. ;; MegaCortex has used .cmd scripts on the victim's system. ;; menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files. ;; Metamorfo has used cmd.exe /c to execute files. ;; Micropsia creates a command-line shell using cmd.exe. ;; MirageFox has the capability to execute commands using cmd.exe. ;; Mis-Type uses cmd.exe to run commands for enumerating the host. ;; Misdat is capable of providing shell functionality to the attacker to execute commands. ;; Mivast has the capability to open a remote shell and run basic commands. ;; MoleNet can execute commands via the command line utility. ;; MoonWind can execute commands via an interactive command shell. MoonWind uses batch scripts for various purposes including to restart and uninstall itself. ;; More_eggs has used cmd.exe for execution. ;; Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server. ;; MuddyWater has used a custom tool for creating reverse shells. ;; MURKYTOP uses the command-line interface. ;; Mustang Panda has executed HTA files via cmd.exe and used batch scripts for collection. ;; NanoCore can open a remote command-line interface and execute commands. NanoCore uses JavaScript files. ;; NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory. ;; NETEAGLE allows adversaries to execute shell commands on the infected host. ;; Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload. ;; NETWIRE can issue commands using cmd.exe. ;; njRAT can launch a command shell interface for executing commands. ;; OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros. ;; OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts. ;; Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version. ;; OopsIE uses the command prompt to execute commands on the victim's machine. ;; Operation Wocao has spawned a new cmd.exe process to execute commands. ;; Orz can execute shell commands. Orz can execute commands with JavaScript. ;; Out1 can use native command line for execution. ;; Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines. ;; PHOREAL is capable of creating reverse shell. ;; Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell. ;; PLAINTEE uses cmd.exe to execute commands on the victim’s machine. ;; PLEAD has the ability to execute shell commands on the compromised host. ;; PlugX allows actors to spawn a reverse shell on a victim. ;; PoetRAT has called cmd through a Word document macro. ;; PoisonIvy creates a backdoor through which remote attackers can open a command-line interface. ;; Pony has used batch scripts to delete itself after execution. ;; PowerDuke runs cmd.exe /c and sends the output to its C2. ;; POWRUNER can execute commands from its C2 server. ;; Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c " > %temp%\PM* .tmp 2>&1". ;; Pteranodon can execute commands on the victim. ;; QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine. ;; QuasarRAT can launch a remote shell to execute commands on the victim’s machine. ;; Ragnar Locker has used cmd.exe and batch scripts to execute commands. ;; Rancor has used cmd.exe to execute commmands. ;; RATANKBA uses cmd.exe to execute commands. ;; RDAT has executed commands using cmd.exe /c. ;; RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell. ;; Remcos can launch a remote command line to execute commands on the victim’s machine. ;; Remexi silently executes received commands with cmd.exe. ;; Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine. ;; REvil can use the Windows command line to delete volume shadow copies and disable recovery. ;; RGDoor uses cmd.exe to execute commands on the victim’s machine. ;; Rising Sun executed commands using cmd.exe. ;; RobbinHood uses cmd.exe on the victim's computer. ;; RogueRobin uses Windows Script Components. ;; RTM uses the command line and rundll32.exe to execute. ;; RunningRAT uses a batch file to kill a security program task and then attempts to remove itself. ;; Ryuk has used cmd.exe to create a Registry entry to establish persistence. ;; Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell. ;; SamSam uses custom batch scripts to execute some of its components. ;; SDBbot has the ability to use the command shell to execute commands on a compromised host. ;; SeaDuke is capable of executing commands. ;; Seasalt uses cmd.exe to create a reverse shell on the infected endpoint. ;; SEASHARPEE can execute commands on victims. ;; ServHelper can execute shell commands against cmd. ;; SharpStage can execute arbitrary commands with the command line. ;; ShimRat can be issued a command shell function from the C2. ;; Silence has used Windows command-line to run commands. ;; SLOTHFULMEDIA can open a command line to execute commands. ;; SNUGRIDE is capable of executing commands and spawning a reverse shell. ;; Sowbug has used command line during its intrusions. ;; Spark can use cmd.exe to run commands. ;; SQLRat has used SQL to execute JavaScript and VB scripts on the host system. ;; StreamEx has the ability to remotely execute commands. ;; Several tools used by Suckfly have been command-line driven. ;; SYSCON has the ability to execute commands through cmd on a compromised host. ;; TA505 has executed commands using cmd.exe. ;; TA551 has used cmd.exe to execute commands. ;; TAINTEDSCRIBE can enable Windows CLI access and execute files. ;; TDTESS provides a reverse shell on the victim. ;; TEXTMATE executes cmd.exe to provide a reverse shell to adversaries. ;; Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands. ;; Threat Group-3390 has used command-line interfaces for execution. ;; TinyZBot supports execution from the command-line. ;; TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine. ;; Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process. ;; Tropic Trooper has used Windows command scripts. ;; TSCookie has the ability to execute shell commands on the infected host. ;; Turla RPC backdoors have used cmd.exe to execute commands. ;; TURNEDUP is capable of creating a reverse shell. ;; TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell. ;; UBoatRAT can start a command shell. ;; Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon providing a reverse shell upon receipt of a special packet ;; UNC2452 used cmd.exe to execute commands on remote machines. ;; UPPERCUT uses cmd.exe to execute commands on the victim’s machine. ;; USBferry can execute various Windows commands. ;; Volgmer can execute commands on the victim's machine. ;; WEBC2 can open an interactive command shell. ;; WellMess can execute command line scripts received from C2. ;; Wiarp creates a backdoor through which remote attackers can open a command line interface. ;; Wizard Spider has used cmd.exe to execute commands on a victim's machine. ;; XTunnel has been used to execute remote commands. ;; Zebrocy uses cmd.exe to execute commands on the system. ;; Zeus Panda can launch an interface where it can execute several commands on the victim’s PC. ;; ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host. ;; ZLib has the ability to execute shell commands. ;; zwShell can launch command-line shells. ;; ZxShell can launch a reverse command shell."
name: Command and Scripting Interpreter: Windows Command Shell