īankshot uses the command-line interface to execute arbitrary commands. īandook is capable of spawning a Windows command shell. īADNEWS is capable of executing commands via cmd.exe. Īdversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell. īackConfig can download and run batch files to execute commands on a compromised host. īabyShark has used cmd.exe to execute commands. ĪuditCred can open a reverse shell on the system to execute commands.

Īstaroth spawns a CMD process to execute commands. APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader. ĪPT41 used cmd.exe /c to execute commands on remote machines. ĪPT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine. ĪPT37 has used the command-line interface. The group also uses a tool to execute commands on remote computers. Īn APT3 downloader uses the Windows command 'cmd.exe' /C whoami. ĪPT29 used cmd.exe to execute commands on remote machines. The group has also used macros to execute payloads. Īn APT28 loader Trojan uses a cmd.exe and batch script to run its payload. ĪPT18 uses cmd.exe to execute commands on the victim’s machine.

ĪPT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.

Īnchor has used cmd.exe to run its self deletion routine. ĪDVSTORESHELL can create a remote shell and run a given command. exploitation with LOWBALL malware, actors created a file containing a list of commands to be executed on the compromised computer. ĪBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host. 4H RAT has the capability to create a remote shell.

Antares autotune 5 crack