cmd

cmd is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. [1]

Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir [2]), deleting files (e.g., del [3]), and copying files (e.g., copy [4]).

ID: S0106
Associated Software: cmd.exe
Type: TOOL
Platforms: Windows
Version: 1.1
Created: 31 May 2017
Last Modified: 20 March 2020

Techniques Used

Domain ID Name Use
Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

cmd is used to execute programs and other actions at the command-line interface.[1]

Enterprise T1083 File and Directory Discovery

cmd can be used to find files and directories with native functionality such as dir commands.[2]

Enterprise T1070 .004 Indicator Removal on Host: File Deletion

cmd can be used to delete files from the file system.[3]

Enterprise T1105 Ingress Tool Transfer

cmd can be used to copy files to/from a remotely connected external system.[4]

Enterprise T1570 Lateral Tool Transfer

cmd can be used to copy files to/from a remotely connected internal system.[4]

Enterprise T1082 System Information Discovery

cmd can be used to find information about the operating system.[2]

Groups That Use This Software

ID Name References
G0071 Orangeworm

[5]

G0093 GALLIUM

[6][7]

G0045 menuPass

[8]

G0060 BRONZE BUTLER

[9]

G0026 APT18

[10]

G0072 Honeybee

[11]

References