What is the authoritative source for Cmd.exe?

Cmd.exe (Cmd.exe) is catalogued in LOLBAS Project + GTFOBins and curated for EU compliance use cases by SQUR.

Windows

Cmd.exeCmd.exe

Platform

Windows

Abuse functions

Mapped techniques

Description

Cmd.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: ADS, Download, Upload. Mapped ATT&CK techniques (per LOLBAS / GTFOBins → MITRE crosswalk): T1105, T1564.004, T1567. Defenders should monitor execution of Cmd.exe under non-administrative or sudo contexts and alert when its arguments match the abuse-function signatures.

Abuse functions· 4

ADST1564.004

Can be used to evade defensive countermeasures or to hide as a persistence mechanism

ADST1059.003

Can be used to evade defensive countermeasures or to hide as a persistence mechanism

DownloadT1105

Download/copy a file from a WebDAV server

UploadT1048.003

Upload a file to a WebDAV server

MITRE ATT&CK techniques· 4

T1564.004 T1059.003 T1105 T1048.003

Uses4

Type	Target	Confidence	Tier
SubTechnique	NTFS File Attributest1564.004	100%	live
SubTechnique	Exfiltration Over Unencrypted Non-C2 Protocolt1048.003	100%	live
Technique	Ingress Tool Transfert1105	100%	live
SubTechnique	Windows Command Shellt1059.003	100%	live