T1059.003Execution

Windows Command Shell

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (ex:.bat…

attack.mitre.org ↗

CVEs5

In 5

Reports0

Detections

46 Sigma rules tagged T1059.003

Windows Command ShellT1059.00346 general rules

Elise Backdoor Activitycriticaltest
Rorschach Ransomware Execution Activitycriticaltest
ZxShell Malwarecriticaltest
HackTool - CrackMapExec Execution Patternshighstable
AWS EC2 Startup Shell Script Changehightest
Conhost.exe CommandLine Path Traversalhightest
Exploited CVE-2020-10189 Zoho ManageEnginehightest
Exploiting SetupComplete.cmd CVE-2019-1378hightest

All 46 on SigmaHQ ↗

CVEs linked to Windows Command Shell

5 CVEs, by priority. Each link shows its badge.

CVE-2025-49704Microsoft SharePoint Code Injection Vulnerability
Microsoft · SharePointKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1059.003Windows Command Shell1 report
MITRE CTID mapping of the KEV entry · primary impact
>99.9%Top 0.01%
83.0priority
CVE-2023-27532Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
Veeam · Backup & ReplicationKEVRansomwarePublic exploitHigh · 7.5T1133External Remote Services T1059.003Windows Command Shell+4 more · 1 report
MITRE CTID mapping of the KEV entry · primary impact
80.6%Top 0.38%
82.0priority
CVE-2025-49706Microsoft SharePoint Improper Authentication Vulnerability
Microsoft · SharePointKEVRansomwarePublic exploitMedium · 6.5T1190Exploit Public-Facing Application T1059.003Windows Command Shell+1 more · 1 report
MITRE CTID mapping of the KEV entry · follow-on activity
99.1%Top 0.07%
81.4priority
CVE-2023-42793JetBrains TeamCity Authentication Bypass Vulnerability
JetBrains · TeamCityKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059.003Windows Command Shell
MITRE CTID mapping of the KEV entry · primary impact
>99.9%Top 0.02%
79.9priority
CVE-2021-40449Microsoft Windows Win32k Privilege Escalation Vulnerability
Microsoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1566Phishing T1059.003Windows Command Shell+6 more
MITRE CTID mapping of the KEV entry · follow-on activity
81.9%Top 0.35%
78.4priority