tfMITRE ATT&CK sub-technique

Windows Command Shell T1059.003

sub-technique of T1059 Command and Scripting Interpreter

Tactic: Execution
Platform: Windows
Version: 1.5
Created: 09 March 2020
Last modified: 12 May 2026

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 1%

Threat groups99th percentile · 99% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 1%

Campaigns99th percentile · 99% of ATT&CK techniques have this many campaigns recorded or fewer.

295

Tools & malwareTop 1%

Tools & malware99th percentile · 99% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 3%

Detection rules97th percentile · 97% of ATT&CK techniques have this many detection rules written or fewer.

Windows Command Shell MITRE reference T1059.003

Top 1%of all ATT&CK techniques for number of groups

73 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has used cmd.exe for malware execution, file discovery, and manual file manipulation.1 2 3 3

created 2026-04-174 referencesaka Earth Kasha

Contagious InterviewG1052 ↗

Has utilized VBS scripts to open cmd.exe and run commands to include the go_batch.bat batch file.1

created 2025-10-191 referenceaka DeceptiveDevelopment

Medusa GroupG1051 ↗

Has used Windows Command Prompt to control and execute commands on the system to include ingress, network, and filesystem enumeration activities.1

created 2025-10-151 reference

UNC3886G1048 ↗

Has executed Windows commands on guest virtual machines through vmtoolsd.exe.1

created 2025-05-291 reference

Storm-1811G1046 ↗

Has used multiple batch scripts during initial access and subsequent actions on victim machines.1 2

created 2025-03-142 references

BlackByteG1043 ↗

Executed ransomware using the Windows command shell.1

created 2024-12-161 referenceaka Hecamede

All 73 groups for this technique · 6 newest in this preview

18 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SharePoint ToolShell ExploitationC0058 ↗

During SharePoint ToolShell Exploitation, threat actors utilized cmd.exe and batch scripts within the victim environment.1 2 3 4

2025

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines.1

2025

Operation Digital EyeC0061 ↗

During Operation Digital Eye, threat actors used cmd.exe as a default method of execution for a custom version of Mimikatz named bK2o.exe.1

2024

Water Curupira Pikabot DistributionC0037 ↗

Installation via JavaScript will launch follow-on commands via cmd.exe.1

2023

APT28 Nearest Neighbor CampaignC0051 ↗

During APT28 Nearest Neighbor Campaign, APT28 used cmd.exe for execution.1

2022–2024

C0015C0015 ↗

During C0015, the threat actors used cmd.exe to execute commands and run malicious binaries.1

2021

All 18 campaigns for this technique · 6 newest in this preview

295 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LAMEHUGS9035 ↗

Can use cmd.exe to display a decoy file to spearphishing victims.1

created 2026-04-21MALWAREcarried by 1 group

MuddyViperS9032 ↗

Has used cmd.exe to launch a reverse shell.1

created 2026-04-20MALWAREcarried by 1 group

IronWindS9029 ↗

Has used the Windows command shell to execute malicious files.1

created 2026-04-20MALWAREcarried by 1 group

HeartCryptS9018 ↗

Can use the reg add command via cmd.exe for Registry modification.1

created 2026-04-16MALWAREcarried by 1 group

HTTPTroyS9007 ↗

Has the ability to generate a reverse shell using the command conn <IP_ADDRESS> <PORT>.1

created 2026-04-08MALWAREcarried by 1 group

DiskpartS9002 ↗

Can execute a disk partition script file, which attempts to mount a virtual hard disk.1 Diskpart can also assign and mount virtual disks.1

created 2026-01-26TOOL

All 295 software entries for this technique · 6 newest in this preview

Offense vs defense T1059.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 16Sigma rules (cumulative) · 46Splunk ESCU (cumulative) · 15

first rule: 2017 Q3 · 16 of 18 campaigns plotted (Night Dragon (dated 2009), Operation AkaiRyū (dated 2004) fall before the 2014 window)

Windows Command Shell detection strategy DET0202

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Windows Command Shell Execution

Enterprise

1 platform

AN0578 · Windows

Detects interactive or scripted abuse of cmd.exe, batch files, or shell invocation chains. Focuses on parent-child relationships (e.g., cmd.exe launched from unusual parents), anomalous command-line parameters, and chaining with discovery, credential access, or lateral movement behaviors.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Script ExecutionDC0029	EDR:scriptblock	Process Tree + Script Block Logging
Process CreationDC0032	WinEventLog:Security	EventCode=4688

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	Cmd.exe launched from uncommon parents (e.g., msedge.exe, winword.exe) may indicate abuse.
TimeWindow	Cmd or .bat execution during non-working hours may indicate automation or C2 activity.
CommandLinePattern	Flags suspicious switches (e.g., /c ping, /k whoami) or command chaining (&&, ^).
ScriptStoragePath	Batch file execution from %TEMP%, C:\Users\Public, or external drives.
UserContext	Flags admin-level users executing cmd outside expected baselines.

2 analytics

The Windows Command Prompt (cmd.exe) is a utility that provides a command line interface to Windows operating systems. It provides the ability to run additional programs and also has several built-in commands such as dir, copy, mkdir, and type, as well as batch scripts (.bat). Typically, when a user runs a command prompt, the parent process is explorer.exe or another instance of the prompt. There may be automated programs, logon scripts, or administrative tools that launch instances of the command prompt in order to run scripts or other built-in commands. Spawning the process cmd.exe from certain parents may be more indicative of malice. For example, if Adobe Reader or Outlook launches a command shell, this may suggest that a malicious document has been loaded and should be investigated. Thus, by looking for abnormal parent processes of cmd.exe, it may be possible to detect adversaries.

TypeSituational AwarenessCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	parent_exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

process = search Process:Create
cmd = filter process where (exe == "cmd.exe")
output cmd

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*cmd\.exe.*)i limit 100

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\cmd.exe"

Unit tests

CAR’s own validation procedures for this analytic.

Within a command prompt or powershell, run cmd.exe

Many programs create command prompts as part of their normal operation including malware used by attackers. This analytic attempts to identify suspicious programs spawning cmd.exe by looking for programs that do not normally create cmd.exe.

TypesAnomaly, TTPCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	parent_exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Create a baseline of parents of cmd.exe seen over the last 30 days and a list of parents of cmd.exe seen today. Remove parents in the baseline from parents seen today, leaving a list of new parents.

processes = search Process:Create
cmd = filter processes where (exe == "cmd.exe")
cmd = from cmd select parent_exe
historic_cmd = filter cmd (where timestamp < now - 1 day AND timestamp > now - 1 day)
current_cmd = filter cmd (where timestamp >= now - 1 day)
new_cmd = historic_cmd - current_cmd
output new_cmd

Tests6Executorscmd 4 · PowerShell 2Need elevation1 of 6Have prerequisites3Have cleanup4Platformswindows

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Create and Execute Batch Script windows PowerShell — 1 Yes

Creates and executes a simple batch script. Upon execution, CMD will briefly launch to run the batch script then close again.

Input arguments

Name	Type	Default	Description
script_path	path	PathToAtomicsFolder\..\ExternalPayloads\T1059.003_script.bat	Script path.
command_to_execute	string	dir	Command to execute within script.

Attack command

Start-Process "#{script_path}"

Cleanup command

Remove-Item "#{script_path}" -Force -ErrorAction Ignore

Prerequisite

Batch file must exist on disk at specified location (#{script_path})

Check

if (Test-Path "#{script_path}") {exit 0} else {exit 1}

Satisfy

New-Item "#{script_path}" -Force | Out-Null
Set-Content -Path "#{script_path}" -Value "#{command_to_execute}"

GUIDe6054aac-6bda-4c88-9deb-76aee208c92b

02 Writes text to a file and displays it. windows cmd — — Yes

Writes text to a file and display the results. This test is intended to emulate the dropping of a malicious file to disk.

Input arguments

Name	Type	Default	Description
message	string	Hello from the Windows Command Prompt!	Message that will be written to disk and then displayed.
file_contents_path	path	%TEMP%\test.bin	Path to the file that the command prompt will drop.

Attack command

echo "#{message}" > "#{file_contents_path}" & type "#{file_contents_path}"

Cleanup command

del "#{file_contents_path}" >nul 2>&1

GUIDe13099f8-f627-45a6-a006-f69c40b20d71

03 Suspicious Execution via Windows Command Shell windows cmd — — —

Command line executed via suspicious invocation. Example is from the 2021 Threat Detection Report by Red Canary.

Input arguments

Name	Type	Default	Description
output_file	string	hello.txt	File to output to
input_message	string	Hello, from CMD!	Message to write to file

Attack command

%LOCALAPPDATA:~-3,1%md /c echo #{input_message} > #{output_file} & type #{output_file}

GUIDad7a3397-a8ec-4e46-8ca7-63ef42ea61da

04 Simulate BlackByte Ransomware Print Bombing windows PowerShell — 1 Yes

This test attempts to open a file a specified number of times in Wordpad, then prints the contents. It is designed to mimic BlackByte ransomware's print bombing technique, where tree.dll, which contains the ransom note, is opened in Wordpad 75 times and then printed. See https://redcanary.com/blog/blackbyte-ransomware/.

Input arguments

Name	Type	Default	Description
max_to_print	integer	75	The maximum number of Wordpad windows the test will open/print.
file_to_print	string	PathToAtomicsFolder\..\ExternalPayloads\T1059_003note.txt	File to be opened/printed by Wordpad.

Attack command

cmd /c "for /l %x in (1,1,#{max_to_print}) do start wordpad.exe /p #{file_to_print}" | out-null

Cleanup command

stop-process -name wordpad -force -erroraction silentlycontinue

Prerequisite

File to print must exist on disk at specified location (#{file_to_print})

Check

if (test-path "#{file_to_print}"){exit 0} else {exit 1}

Satisfy

new-item "#{file_to_print}" -value "This file has been created by T1059.003 Test 4" -Force | Out-Null

GUIDffa8d94c-63c3-458e-aa13-9e20d391d1ba

05 Command Prompt read contents from CMD file and execute windows cmd — 1 —

Simulate Raspberry Robin using the "standard-in" command prompt feature cmd /R < to read and execute a file via cmd.exe See https://redcanary.com/blog/raspberry-robin/.

Input arguments

Name	Type	Default	Description
input_file	path	PathToAtomicsFolder\T1059.003\src\t1059.003_cmd.cmd	CMD file that is read by Command Prompt and execute, which launches calc.exe

Attack command

cmd /r cmd<"#{input_file}"

Prerequisite

CMD file must exist on disk at specified location (#{input_file})

Check

if (Test-Path "#{input_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{input_file}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1059.003/src/t1059.003_cmd.cmd" -OutFile "#{input_file}"

GUID05a57b4a-c946-4feb-b8be-aefb59ae31c1

06 Command prompt writing script to file then executes it windows cmd Required — Yes

Simulate DarkGate malware's second stage by writing a VBscript to disk directly from the command prompt then executing it. The script will execute 'whoami' then exit.

Input arguments

Name	Type	Default	Description
script_name	string	AtomicTest	Script name (without the extension)
script_path	path	%TEMP%\	Path in which the script will be written.

Attack command

 c:\windows\system32\cmd.exe /c cd /d #{script_path} & echo Set objShell = CreateObject("WScript.Shell"):Set objExec = objShell.Exec("whoami"):Set objExec = Nothing:Set objShell = Nothing > #{script_name}.vbs & #{script_name}.vbs

Cleanup command

del "#{script_name}.vbs" >nul 2>&1

GUIDb4b53400-5f2f-4ed2-92d4-3ce7db0f2bbc

Tests from Atomic Red Team (MIT licence) · technique definition

Windows Command Shell detections T1059.003

61 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 3%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs