Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of…
Sub-technique of Command and Scripting Interpreter (T1059).
T1059.003 Command and Scripting Interpreter: Windows Command Shell
title: "T1059.003 Command and Scripting Interpreter: Windows Command Shell"
id: e45dfad8-a13a-44a9-975d-cc15631d48f7
description: 'Detects cmd.exe launched by a non-shell, scriptable/automatable parent process (Office applications, mshta.exe, wscript.exe/cscript.exe, WMI, rundll32.exe) -- a strong signal of command-and-scripting-interpreter abuse (e.g. macro- or script-driven command execution) rather than interactive shell use. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentProcessName, TimeWindow, CommandLinePattern, ScriptStoragePath, UserContext.'
references:
- https://attack.mitre.org/techniques/T1059/003
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
- attack.execution
- attack.t1059.003
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection:
Image|endswith: '\cmd.exe'
selection_parent_suspicious:
ParentImage|endswith:
- '\winword.exe'
- '\excel.exe'
- '\powerpnt.exe'
- '\outlook.exe'
- '\mshta.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\wmiprvse.exe'
- '\rundll32.exe'
filter_system_account:
User|contains:
- 'SYSTEM'
- 'LOCAL SERVICE'
- 'NETWORK SERVICE'
condition: selection and selection_parent_suspicious and not filter_system_account
falsepositives:
- Legitimate Office macros, HTA tools, or WMI/administration scripts that intentionally shell out to cmd.exe as part of approved automation; System and service accounts are excluded via filter_system_account; tune further with known-good macro/deployment-tool allowlists if noise remains.
level: medium