MITRE ATT&CKsub-technique

T1059.003 Windows Command Shell

Published 2020-03-09 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Windows
Version
1.5
Created
2020-03-09

Description

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1059 Command and Scripting Interpreter technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1038 Execution Prevention mitigation

Referenced by MITRE ATT&CK · uses (389)

  • S9067 TWOSTROKE software (malware)
  • S9052 MiniFast software (malware)
  • S9051 The Gentlemen Ransomware software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9035 LAMEHUG software (malware)
  • S9029 IronWind software (malware)
  • S9032 MuddyViper software (malware)
  • C0061 Operation Digital Eye campaign
  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S9018 HeartCrypt software (malware)
  • S9007 HTTPTroy software (malware)
  • S9002 Diskpart software (tool)
  • S9001 SystemBC software (malware)
  • G1052 Contagious Interview group
  • S1247 Embargo software (malware)
  • S1244 Medusa Ransomware software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1239 TONESHELL software (malware)
  • S1229 Havoc software (malware)
  • S1228 PUBLOAD software (malware)
  • G1048 UNC3886 group
  • S1212 RansomHub software (malware)
  • S1211 Hannotog software (malware)
  • G1046 Storm-1811 group
  • C0051 APT28 Nearest Neighbor Campaign campaign
  • S1199 LockBit 2.0 software (malware)
Show all 389 ›

Referenced by Compliance · mitigates (12)

  • CIS-2.7 Allowlist Authorized Scripts CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References