Threat intelligence / Tool

cmd

[cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd) Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir (Citation: TechNet Dir)), deleting files (e.g., del (Citation: TechNet Del)), and copying files (e.g., copy (Citation: TechNet Copy)).

Tool

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd) Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir (Citation: TechNet Dir)), deleting files (e.g., del (Citation: TechNet Del)), and copying files (e.g., copy (Citation: TechNet Copy)).

Labels

tool

13 recorded

Relationships

uses

from APT18

Group

uses

from BRONZE BUTLER

Group

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Lateral Tool Transfer

Technique

uses

to System Information Discovery

Technique

uses

to Windows Command Shell

Technique

uses

Group

uses

Group

uses

from Operation Honeybee

Campaign

uses

from Orangeworm

Group

uses

from Volt Typhoon

Group

5 external

References

mitre-attack

S0106

TechNet Cmd

https://technet.microsoft.com/en-us/library/bb490880.aspx

TechNet Copy

https://technet.microsoft.com/en-us/library/bb490886.aspx

TechNet Del

https://technet.microsoft.com/en-us/library/cc771049.aspx

TechNet Dir

https://technet.microsoft.com/en-us/library/cc755121.aspx