T1059.003: Windows Command Shell
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.CitationSSH in Windows
Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.
Security context for executives and security teams
Windows Command Shell matters because cmd.exe is a built-in Windows execution path that administrators and adversaries can both use. Its business risk is not that cmd.exe exists, but that it can turn a foothold, remote service session, or batch file into hands-on-keyboard execution across endpoints and servers. For leaders, this technique is a coverage test: can the organization distinguish normal administration from suspicious command execution quickly enough to support incident response decisions?
Executive priority
Prioritize this as a foundational Windows execution control and monitoring issue. ATT&CK links this sub-technique to many campaigns and groups, including espionage, ransomware, supply chain, and disruptive activity examples, which makes it a common denominator rather than a niche behavior. Executives should ask whether endpoint logging, command-line visibility, application control, and incident response playbooks can produce defensible evidence of who launched cmd.exe, from where, with what command context, and on which systems.
Technical view
This is an Execution tactic sub-technique for Windows under Command and Scripting Interpreter. SOC and IR teams should validate behavioral detection for cmd.exe and batch execution, especially unusual parent-child process relationships, command-line arguments, interactive use, execution through remote services such as SSH where present, and cmd.exe used to launch payloads or chain other tools. The supplied ATT&CK object has no official detection text, but it is related to DET0202, Behavioral Detection of Windows Command Shell Execution, and M1038, Execution Prevention.
Likely telemetry
- Endpoint process creation events with full command-line arguments
- Parent and child process relationships for cmd.exe
- Batch file execution evidence for .bat and .cmd files
- User, logon session, host, and integrity or privilege context for command execution
- Remote service session logs where Windows SSH or other remote access paths are enabled
Detection direction
- Validate that command-line logging is enabled and retained for Windows endpoints and servers where business risk is highest.
- Tune detections around context, not cmd.exe alone: parent process, user role, host role, command content, remote session origin, and follow-on child processes are usually decisive.
- Baseline legitimate administrative and automation use so detections do not overwhelm the SOC with routine batch jobs or management tooling.
- Hunt for cmd.exe spawned from unusual applications, remote access contexts, service accounts, or processes that do not normally launch shells.
- Correlate shell execution with other execution, lateral movement, persistence, or payload events rather than treating isolated cmd.exe launches as conclusive.
Mitigation priorities
- Start with visibility: ensure endpoint process and command-line telemetry is collected before relying on detections or audit evidence.
- Apply execution prevention controls consistent with M1038, including application control and script or execution blocking where operationally feasible.
- Restrict unnecessary remote service access to Windows systems and review where SSH or similar remote administration paths are enabled.
- Limit administrative privileges and service account usage so command shell execution does not automatically provide broad operational reach.
- Document approved administrative uses of cmd.exe and batch files to support exception handling, audit readiness, and faster incident triage.
Additional notes and limits
The key defensive value is context. Cmd.exe is legitimate and widely used, so high-quality coverage depends on command-line visibility, identity context, process lineage, and knowledge of normal administration patterns. The relationship set shows this technique appears across numerous ATT&CK campaigns and groups, supporting its priority as a common execution behavior, but those relationships should not be interpreted as evidence of current activity in any specific environment.
The official ATT&CK object does not provide detection guidance, and the supplied relationship descriptions are partial for some related objects. This take is limited to the Windows platform and Execution tactic stated in the object. Local telemetry, business-critical asset lists, administrative baselines, and enabled remote services are required to determine actual exposure or detection coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Windows Command Shell
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.CitationSSH in Windows
Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.