cmd.exe

Overview

cmd.exe is the Windows Command Processor.

It provides a command-line interface for:

It is one of the oldest and most widely-used Windows components and remains heavily utilised by administrators, installers, enterprise tooling, and attackers. 【1-6b6bcd】

Expected Characteristics

Expected Locations

Expected Parents

Common examples include:

Typical Profile

Why This Matters

cmd.exe can appear at virtually any stage of an intrusion.

Attackers frequently use it because it provides a simple way to:

Unlike some Windows binaries that have very narrow use cases, cmd.exe is so common that context becomes more important than process existence. 【1-6b6bcd】

Common Investigation Scenarios

Analysts frequently encounter cmd.exe during:

Investigation Objective

Determine:

The command line is usually the most valuable artefact during a cmd.exe investigation.

Normal Behaviour

Characteristics

Path

Signature

Parent Processes

Common examples include:

Children

May legitimately launch:

Child processes should align with a documented workflow.

Lifetime

Typical Activity

Legitimate examples include:

Expected Behavioural Characteristics

Legitimate cmd.exe activity generally:

Abuse Patterns

Suspicious Parent Processes

Investigate cmd.exe launched by:

These parent-child relationships frequently appear during malware delivery and phishing campaigns. 【1-6b6bcd】

LOLBin Chaining

Investigate cmd.exe launching:

powershell.exe

wscript.exe

cscript.exe

mshta.exe

rundll32.exe

regsvr32.exe

schtasks.exe

certutil.exe

bitsadmin.exe

curl.exe

While legitimate uses exist, extensive chaining often indicates malicious execution. 【1-6b6bcd】

Obfuscated Command Lines

Investigate:

Examples include:

^

&

|

>

>>

Complexity alone is not malicious, but unusual complexity should increase investigative priority. 【1-6b6bcd】

User-Writable Execution Paths

Investigate scripts and binaries launched from:

Particularly when the files are newly created or low-prevalence.

Batch-Based Staging

Attackers frequently use cmd.exe to:

The command processor often serves as a bridge between initial access and payload execution.

Remote Execution Activity

Investigate cmd.exe used in conjunction with:

Particularly when activity is observed across multiple systems.

Persistence Activity

Review execution that modifies:

Many persistence mechanisms rely on cmd.exe wrappers.

Detection Opportunities

Command-Line Analytics

The command line is usually the most valuable source of telemetry.

Monitor for:

Rare command lines often provide stronger signals than common administrative activity.

Parent Process Monitoring

Investigate:

winword.exe
    → cmd.exe

excel.exe
    → cmd.exe

browser.exe
    → cmd.exe

These chains frequently appear during initial access events.

Child Process Monitoring

Investigate cmd.exe spawning:

The child process often reveals the attacker’s objective.

File and Script Monitoring

Review:

The file being executed frequently contains the strongest evidence.

Network Analytics

Investigate when cmd.exe activity correlates with:

Many command chains eventually interact with remote infrastructure.

Hunting Opportunities

Useful hunting pivots include:

Prioritise unusual behaviour over sheer volume.

False Positives

cmd.exe is heavily used throughout enterprise environments.

Context is critical.

Common Legitimate Scenarios

Examples include:

Developer Activity

Developers frequently generate:

This frequently resembles attacker tradecraft at first glance.

Enterprise Automation

Examples include:

Many enterprise systems rely on cmd.exe to orchestrate workflows.

Validation Questions

Check:

Determine whether the activity aligns with a legitimate operational process.

Estate Context

Legitimate command lines often:

Hardening Recommendations

Reduce Interpreter Chaining

Review workflows that unnecessarily chain:

Simpler workflows are generally easier to monitor and secure.

Application Control

Consider:

Prevent execution of unauthorised binaries and scripts.

Restrict User-Writable Execution

Reduce opportunities for execution from:

Many attacker workflows rely on these locations.

Improve Logging

Enable visibility into:

High-quality telemetry is essential for cmd.exe investigations.

Monitor Administrative Tooling

Review:

A clear baseline significantly reduces false positives.

Defensive Validation

Regularly test:

Controls should be validated against realistic attacker workflows.

Triage Checklist

Identity and Integrity

Lineage and Behaviour

File and Script Context

Network and Execution Context

Scope and Correlation

Escalation Considerations

Escalate immediately when:

ATT&CK References

Windows Processes

Windows Scripting

MITRE ATT&CK