T1059.003 Windows Command Shell — Attack Simulation

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (ex: .bat or .cmd) also provide the shell with a list of…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Command prompt writing script to file then executes it
windows automated command_prompt
Procedure 00682c9f-7df4-4df8-950b-6dcaaa3ad9af; elevation required; cleanup present, not reviewed. Not executed or individually validated.
Writes text to a file and displays it.
windows automated command_prompt
Procedure 127b4afe-2346-4192-815c-69042bec570e; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Simulate BlackByte Ransomware Print Bombing
windows automated powershell
Procedure 6b2903ac-8f36-450d-9ad5-b220e8a2dcb9; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Create and Execute Batch Script
windows automated powershell
Procedure 9e8894c0-50bd-4525-a96c-d4ac78ece388; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Suspicious Execution via Windows Command Shell
windows automated command_prompt
Procedure d0eb3597-a1b3-4d65-b33b-2cda8d397f20; elevation not declared required; cleanup not declared. Not executed or individually validated.
Command Prompt read contents from CMD file and execute
windows automated command_prompt
Procedure df81db1b-066c-4802-9bc8-b6d030c3ba8e; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows execution isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate subtechnique source_mapped

Detection and collection

T1059.003 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Connected anomaly research

Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.

Parent-Child Execution

Telemetry contracts · Maintained query examples · Validation and blind spots

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.