cmd

MITRE ATT&CK: S0106 View on attack.mitre.org

Aliases: cmd.exe, cmd

Operating systems
windows
Profile updated
2026-07-07 15:32:20

Context

cmd is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir), deleting files (e.g., del), and copying files (e.g., copy).

Detection coverage

  • 2 YARA rules
  • 167 Sigma rules

Malware & tools used

  • File and Directory Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • System Information Discovery (attack-pattern)
  • File Deletion (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Lateral Tool Transfer (attack-pattern)

Used by threat actors

Detection rules

  • ELCEEF_Suspicious_SFX (yara-rule)
  • SEKOIA_Apt_Darkpink_Sample (yara-rule)

Reports & references

  • MITRE ATT&CK — S0106 (report)
  • Microsoft — Bb490880 (report)
  • Microsoft — Bb490886 (report)
  • Microsoft — Cc755121 (report)
  • Microsoft — Cc771049 (report)

External references