| 0️⃣1️⃣ |
powershell.exe |
C:\Windows\System32\ WindowsPowerShell\v1.0\ powershell.exe |
"Opens a new instance of the command prompt" |
Queried Windows, Security event logs and exported results to .dat files to track logon activity and identify lateral-movement targets |
T1059.001 |
Execution / Persistence, & Defense Impairment |
| 0️⃣2️⃣ |
wmic.exe |
C:\Windows\System32\ntdsutil.exe |
WMI command-line interface for system management. Used to enumerate running processes |
"The actor has executed the following command to gather information about local drives" |
T1082 |
Execution, Discovery, & Lateral Movement |
| 0️⃣3️⃣ |
ntdsutil.exe |
C:\Windows\System32\ntdsutil.exe |
AD database maintenance utility |
Used by attackers to AD database and registry hives from a domain controller |
T1003.003 |
Credential Access |
| 0️⃣4️⃣ |
netsh.exe |
C:\Windows\System32\netsh.exe |
Scripting utility used to interact with networking components on local or remote systems |
Adversaries write registry values under HKLM\SOFTWARE\Microsoft\Netsh to register their own malicious DLL |
S0108 |
Persistence & Lateral Movement |
| 0️⃣5️⃣ |
vssadmin.exe |
C:\Windows\System32\vssadmin.exe |
Volume Shadow Copy Service admin tool |
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. |
T1490 |
Defense Impairment |
| 0️⃣6️⃣ |
certutil.exe |
C:\Windows\System32\certutil.exe |
Used to obtain certificate authority information and configure Certificate Services |
Because it is signed by Microsoft, and pre-installed on all Windows systems, threat actors use it to bypass traditional security controls and signature-based detection |
S0160 |
Execution & Defense Impairment |
| 0️⃣7️⃣ |
reg.exe |
C:\Windows\System32\reg.exe |
Registry editor CLI, used for registry querying, including enumerating stored PuTTY session data. |
Used to query, modify, or delete entries in the Windows Registry |
S0075 |
Persistence & Credential Access |
| 0️⃣8️⃣ |
netstat.exe |
C:\Windows\System32\netstat.exe |
An operating system utility that displays active TCP connections, listening ports, and network statistics |
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. |
S0104 |
Discovery |
| 0️⃣9️⃣ |
tasklist.exe |
C:\Windows\System32\tasklist.exe |
Displays a list of applications and services with their Process IDs |
Can be used to discover processes running on a system |
S0057 |
Discovery |
| 1️⃣0️⃣ |
net.exe |
C:\Windows\System32\net.exe |
Used in command-line operations for control of users, groups, services, and network connections. |
Used for gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services |
S0039 |
Discovery & Lateral Movement |
| 1️⃣1️⃣ |
quser.exe |
C:\Windows\System32\quser.exe |
Displays information about logged-on user sessions |
Used to identify currently logged-on users and active sessions |
T1033 / T1057 |
Discovery |
| 1️⃣2️⃣ |
whoami.exe |
C:\Windows\System32\whoami.exe |
Displays current user/privilege context |
Used to verify integrity level, username, and whether they landed in a low-privileged or high-privileged context |
T1033 |
Discovery |