Windows Command Shell
Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/technique...
BY SOURCE
PROCEDURES (49)
Auto-extracted: 10 detections for process creation monitoring
Auto-extracted: 6 detections for script execution monitoring
Auto-extracted: 4 detections for powershell
Auto-extracted: 3 detections for general monitoring
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for phish
Auto-extracted: 2 detections for evasion
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for child process
Auto-extracted: 2 detections for remote
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for startup
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for startup
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for suspicious