Windows Command Shell (MITRE ATT&CK T1059.003) is an execution technique on Windows. The command prompt, cmd, can control almost any part of the system, with different commands needing different permission levels. Because it is always there, it is a favorite place to run things.
How attackers use it
MITRE describes a few patterns. Adversaries use cmd to run a single command or a payload. They run it interactively, with input and output forwarded over a command and control channel. The prompt can also be reached remotely through remote services such as SSH.
Batch files (.bat or .cmd) feed the shell a list of commands with conditionals and loops. Administrators use them for repetitive tasks across many systems, and adversaries use them for the same reason.
How to detect it
MITRE's detection strategy for this technique watches how cmd.exe is used:
- Parent child relationships, such as cmd.exe started by unusual parents like an Office application or a web server process.
- Anomalous command line parameters.
- Chaining with discovery, credential access or lateral movement commands.
Data to collect: process creation events with full command lines. Two common sources are Windows Security event ID 4688 and Sysmon event ID 1. Baseline which parents normally start cmd.exe on a server versus a workstation, then alert on departures.
How to reduce the risk
MITRE lists execution prevention: use application control where appropriate. In practice that means deciding where cmd.exe and batch scripts are needed at all, and restricting them on systems that never need an interactive prompt, such as kiosks or web servers.
Check your own environment
Windows, read-only checks from an elevated prompt:
auditpol /get /category:"Detailed Tracking"
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit /v ProcessCreationIncludeCmdLine_Enabled
The first shows whether process creation auditing is on. The second shows whether command lines are included in event 4688. If the value is missing or 0, command lines are not being recorded by that policy.
Quick check
Why is the parent process so useful here?
cmd.exe itself is normal. A parent that has no reason to launch a shell, such as a document viewer, is what makes the event suspicious.
Sources
- MITRE ATT&CK, Windows Command Shell: https://attack.mitre.org/techniques/T1059/003
