cmd
Software · ATTACK:enterprise:S0106
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0106",
"title": "cmd",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0106",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--bba595da-b73a-4354-aa6c-224d4de7cb4e",
"external_id": "S0106",
"domain": "enterprise",
"created": "2017-05-31T21:33:05.319Z",
"modified": "2025-04-16T20:38:55.702Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "TechNet Cmd",
"url": "https://technet.microsoft.com/en-us/library/bb490880.aspx"
},
{
"source_name": "TechNet Copy",
"url": "https://technet.microsoft.com/en-us/library/bb490886.aspx"
},
{
"source_name": "TechNet Del",
"url": "https://technet.microsoft.com/en-us/library/cc771049.aspx"
},
{
"source_name": "TechNet Dir",
"url": "https://technet.microsoft.com/en-us/library/cc755121.aspx"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a20969e-c201-47cd-ac08-8e1a9c764512
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c09a27c-2eea-4287-9908-964533234e71
TechNet DirATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c13a056-b82d-4f56-a530-8562e0e9b038
TechNet CopyATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42897880-fe55-4f54-a42c-f85ba19fb39a
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--745106bb-3641-488e-ae1c-547cd6ea9b7a
TechNet DirATTACK:enterprise:G0026 → uses → ATTACK:enterprise:S0106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89c6bcd7-e330-4902-8296-0918923d6573
Dell Lateral MovementATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99800503-d535-4fae-a318-dfa034dca663
PWC Cloud Hopper Technical Annex April 2017ATTACK:enterprise:G0071 → uses → ATTACK:enterprise:S0106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8f41a5a-b6bd-4446-8f9d-22d0e7b4af74
Symantec Orangeworm April 2018ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7d3cf5c-e541-4639-95c6-8cdea60b084d
TechNet DelATTACK:enterprise:C0006 → uses → ATTACK:enterprise:S0106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc107dd0-bf7c-4b8d-9262-e487a1ac9f2c
McAfee HoneybeeATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8695cbf-80d1-4302-8b79-9667ba171735
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb60b027-facd-4be2-b8b2-0fb9351ea235
TechNet CmdATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb866766-d3a5-46f6-9d0e-afc6bd1c7962
TechNet Copy