T1059.003 Windows Command Shell
sub-techniqueEnterpriseAdversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (ex:.bat or.cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (3)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.DSData Securitystrong · backed by 7 of 11 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 4 of 11 mapped controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 4 of 11 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (11)
Security controls that mitigate this.
known-exploited CVEs (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-49706US | —OT critical | KEV | ||
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2025-49704US | —OT critical | KEV | ||
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2023-42793US | critical9.8OT critical | KEV | ||
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible | ||||
| CVE-2023-27532US | high7.5OT critical | KEV | ||
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backu… | ||||
| CVE-2021-40449US | medium4.6OT critical | KEV | ||
Win32k Elevation of Privilege Vulnerability | ||||
| CVE-2021-22899US | high8.8OT critical | KEV | ||
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profil… | ||||
groups (73)
Threat groups associated with this.
software (298)
Malware and tools associated with this.
campaigns (18)
Campaigns that use this.
Detected by (Sigma) (46)
Sigma detection rules related to this.
source
Where this definition is published.