| ID | Name |
|---|---|
| T1701.001 | PowerShell |
| T1701.002 | Windows Command Shell |
| T1701.003 | Unix Shell |
| T1701.004 | Visual Basic |
| T1701.005 | Python |
| T1701.006 | JavaScript |
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems which is used in industrial control system environments. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services (e.g., Telnet, SSH, RDP, etc.)
Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.
Within industrial control system networks, adversaries may abuse the use of Windows Command Shell on overlap assets that run on Microsoft Windows operating systems (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.).
| ID | Name | Description |
|---|---|---|
| C0025 | 2016 Ukraine Electric Power Attack |
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized VBS and batch scripts for file movement and as wrappers for PowerShell execution.[1] |
| C0034 | 2022 Ukraine Electric Power Attack |
During the 2022 Ukraine Electric Power Attack, Sandworm Team utilizes a Visual Basic script |
| S0604 | Industroyer |
The name of the Industroyer payload DLL is supplied by the attackers via a command line parameter supplied in one of the main backdoors that executes shell commands. [3] |
| G0034 | Sandworm Team |
Sandworm Team uses the MS-SQL server xp_cmdshell command, and PowerShell to execute commands. [4] |
| S0603 | Stuxnet |
Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell with the following command: |
| ID | Mitigation | Description |
|---|---|---|
| M0938 | Execution Prevention |
Restrict cmd.exe, batch files, and command-shell child processes to approved binaries, paths, parent processes, accounts, and maintenance workflows on Windows-based ICS assets. Preserve documented vendor and engineering dependencies. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0930 | Behavioral Detection of Windows Command Shell Execution in ICS | AN2087 |
Real-time monitoring identifies cmd.exe or .bat/.cmd execution from an unexpected parent or user context, execution from transient/user-writable paths, suspicious command chaining, or shell activity followed by OT-relevant discovery, credential, remote-access, or configuration behavior. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance. |