CmdID

CmdID / Commands

doskey

Calls Doskey.exe, which recalls previously entered command-line commands, edits command lines, and creates macros. Windows commands reference

On Windows 1 Sigma rule name it File doskey.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0
doskey [/reinstall] [/listsize=<size>] [/macros:[all | <exename>] [/history] [/insert | /overstrike] [/exename=<exename>] [/macrofile=<filename>] [<macroname>=[<text>]]
doskey /macros > macinit
doskey /macrofile=macinit
doskey /history> tmp.bat
doskey tx=cd temp$tdir/w $*
doskey mc=md $1$tcd $1
mc books
doskey /exename=ftp.exe go=open 172.27.1.100$tmget *.TXT c:\reports$tbye
go
doskey qf=format $1 /q /u
qf a:
doskey vlist =
/reinstallInstalls a new copy of Doskey.exe and clears the command history buffer.
/listsize=<size>Specifies the maximum number of commands in the history buffer.
/macrosDisplays a list of all doskey macros. You can use the redirection symbol (>) with /macros to redirect the list to a file. You can abbreviate /macros to /m.
/macros:allDisplays doskey macros for all executables.
/macros:<exename>Displays doskey macros for the executable specified by exename.
/historyDisplays all commands that are stored in memory. You can use the redirection symbol (>) with /history to redirect the list to a file. You can abbreviate /history as /h.
/insertSpecifies that new text you type is inserted in old text.
/overstrikeSpecifies that new text overwrites old text.
/exename=<exename>Specifies the program (that is, executable) in which the doskey macro runs.
/macrofile=<filename>Specifies a file that contains the macros that you want to install.
<macroname>=[<text>]Creates a macro that carries out the commands specified by Text. MacroName specifies the name you want to assign to the macro. Text specifies the commands you want to record. If Text is left blank, MacroName is cleared of any assigned commands.
/?Displays help at the command prompt.

Windows

from tldr-pages, CC BY 4.0

Manage macros, windows commands, and command-lines.

List available macros

doskey /macrosIdentify
/macrosDisplays a list of all doskey macros. Windows commands reference

Create a new macro

doskey name = "command"Identify

Create a new macro for a specific executable

doskey /exename=executable name = "command"Identify
/exenameSpecifies the program (that is, executable) in which the doskey macro runs. Windows commands reference

Remove a macro

doskey name =Identify

Display all commands that are stored in memory

doskey /historyIdentify
/historyDisplays all commands that are stored in memory. Windows commands reference

Save macros to a file for portability

doskey /macros >path\to\macinit_fileIdentify
/macrosDisplays a list of all doskey macros. Windows commands reference

Load macros from a file

doskey /macrofile = path\to\macinit_fileIdentify
/macrofileSpecifies a file that contains the macros that you want to install. Windows commands reference

What detects it

Sigma process creation rules that name doskey
mediumRecon Information for Export with Command Promptfrack113