CmdID / Techniques / T1059

T1059.003 Command and Scripting Interpreter: Windows Command Shell

Adversaries may abuse the Windows command shell for execution. MITRE ATT&CK

3 programs on CmdID 34 Sigma rules T1059.003 on attack.mitre.org

Part of

MITRE ATT&CK

T1059Command and Scripting Interpreter

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

cmd.exeADS conhost.exeits Sigma rules hh.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

criticalElise Backdoor ActivityFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

criticalRorschach Ransomware Execution ActivityX__Junior (Nextron Systems) · Windows

criticalZxShell MalwareFlorian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · Windows

highAxios NPM Compromise Indicators - WindowsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highConhost.exe CommandLine Path TraversalNasreddine Bencherchali (Nextron Systems) · Windows

highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems) · Windows

highExploiting SetupComplete.cmd CVE-2019-1378Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · Windows

highHackTool - CrackMapExec ExecutionFlorian Roth (Nextron Systems) · Windows

highHackTool - CrackMapExec Execution PatternsThomas Patzke · Windows

highHackTool - Koadic Executionwagga, Jonhnathan Ribeiro, oscd.community · Windows

highHackTool - RedMimicry Winnti Playbook ExecutionAlexander Rausch · Windows

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows

highOperator Bloopers Cobalt Strike Commands_pete_0, TheDFIRReport · Windows

highOperator Bloopers Cobalt Strike Modules_pete_0, TheDFIRReport · Windows

highPotential Baby Shark Malware ActivityFlorian Roth (Nextron Systems) · Windows

highPotential CommandLine Path Traversal Via Cmd.EXExknow @xknow_infosec, Tim Shelton · Windows

highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar · Windows

highSofacy Trojan Loader ActivityFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows

highSuspicious HH.EXE ExecutionMaxim Pavlunin · Windows

highSuspicious HWP Sub ProcessesFlorian Roth (Nextron Systems) · Windows

highSuspicious Process Spawned by CentreStack Portal AppPoolJason Rathbun (Blackpoint Cyber) · Windows

mediumCommand Line Execution with Suspicious URL and AppData StringsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows

mediumHackTool - Jlaive In-Memory Assembly ExecutionJose Luis Sanchez Martinez (@Joseliyo_Jstnk) · Windows

mediumOpenEDR Spawning Command Shell@kostastsale · Windows

mediumPotential APT FIN7 Exploitation ActivityAlex Walston (@4ayymm) · Windows

mediumPotential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXEAlejandro Houspanossian ('@lekz86') · Windows

mediumPowershell Executed From Headless ConHost ProcessMatt Anderson (Huntress) · Windows

mediumPUA - AdvancedRun ExecutionFlorian Roth (Nextron Systems) · Windows

mediumRead Contents From Stdin Via Cmd.EXEfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumSuspicious Child Process of SAP NetWeaverElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · Linux

mediumSuspicious CrushFTP Child ProcessCraig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumSuspicious Usage of For Loop with Recursive Directory Search in CMDJoseliyo Sanchez, @Joseliyo_Jstnk · Windows

lowRemote Access Tool - ScreenConnect Remote Command ExecutionAli Alwashali · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To change the default directory on a drive that is different from the one you are on on the page for cd

cd [<drive>:[<directory>]]Identify

To verify the change to the directory, type on the page for cd

cd [<drive>:]Identify

An example is here when CmdID’s reading of it names T1059.003: a Sigma rule it trips is tagged with it, or its abuse is documented as it.