The sub-techniques beta is now live! Read the release blog post for more info.


xCmd is an open source tool that is similar to PsExec and allows the user to execute applications on remote systems. [1]

ID: S0123
Type: TOOL
Platforms: Windows
Version: 1.0
Created: 31 May 2017
Last Modified: 17 October 2018

Techniques Used

Domain ID Name Use
Enterprise T1035 Service Execution

xCmd can be used to execute binaries on remote systems by creating and starting a service.[1]

Groups That Use This Software

ID Name References
G0006 APT1 [2]