🧰 cmd.exe

The items that name it 4

• Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
  writeup2026-09-09

  Native Windows command shell used by rogue ScreenConnect clients to execute follow-on payload retrieval

• Unmasking an Attack Chain of MuddyWater
  writeup2026-03-06

  Command shell used in the original RDP session environment for reconnaissance commands

• LOLBins: What are they & How to Detect Them
  article2025-01-09

  Command prompt used to launch native utilities like net.exe, often as process parent in LOLBin attacks

• Windows explorer restrictions bypasses - filesystem access
  writeup2024-04-08

  Command-line interface used to bypass NoViewOnDrive and NoNetConnectDisconnect restrictions