cmd is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities.
Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir ), deleting files (e.g., del ), and copying files (e.g., copy ).
| Technique | Procedure example |
|---|---|
| T1059.003 Windows Command Shell |
cmd is used to execute programs and other actions at the command-line interface. |
| T1070.004 File Deletion |
cmd can be used to delete files from the file system. |
| T1082 System Information Discovery |
cmd can be used to find information about the operating system. |
| T1083 File and Directory Discovery |
cmd can be used to find files and directories with native functionality such as |
| T1105 Ingress Tool Transfer |
cmd can be used to copy files to/from a remotely connected external system. |
| T1570 Lateral Tool Transfer |
cmd can be used to copy files to/from a remotely connected internal system. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
