aol.pm

cmd

Software · ATTACK:enterprise:S0106

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0106",
  "title": "cmd",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0106",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--bba595da-b73a-4354-aa6c-224d4de7cb4e",
  "external_id": "S0106",
  "domain": "enterprise",
  "created": "2017-05-31T21:33:05.319Z",
  "modified": "2025-04-16T20:38:55.702Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "TechNet Cmd",
      "url": "https://technet.microsoft.com/en-us/library/bb490880.aspx"
    },
    {
      "source_name": "TechNet Copy",
      "url": "https://technet.microsoft.com/en-us/library/bb490886.aspx"
    },
    {
      "source_name": "TechNet Del",
      "url": "https://technet.microsoft.com/en-us/library/cc771049.aspx"
    },
    {
      "source_name": "TechNet Dir",
      "url": "https://technet.microsoft.com/en-us/library/cc755121.aspx"
    }
  ]
}

Explicit source assertions (13)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a20969e-c201-47cd-ac08-8e1a9c764512

Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019

ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c09a27c-2eea-4287-9908-964533234e71

TechNet Dir

ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c13a056-b82d-4f56-a530-8562e0e9b038

TechNet Copy

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42897880-fe55-4f54-a42c-f85ba19fb39a

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--745106bb-3641-488e-ae1c-547cd6ea9b7a

TechNet Dir

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:S0106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89c6bcd7-e330-4902-8296-0918923d6573

Dell Lateral Movement

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99800503-d535-4fae-a318-dfa034dca663

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:G0071 → uses → ATTACK:enterprise:S0106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8f41a5a-b6bd-4446-8f9d-22d0e7b4af74

Symantec Orangeworm April 2018

ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7d3cf5c-e541-4639-95c6-8cdea60b084d

TechNet Del

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:S0106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc107dd0-bf7c-4b8d-9262-e487a1ac9f2c

McAfee Honeybee

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8695cbf-80d1-4302-8b79-9667ba171735

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb60b027-facd-4be2-b8b2-0fb9351ea235

TechNet Cmd

ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb866766-d3a5-46f6-9d0e-afc6bd1c7962

TechNet Copy

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.