wiki created

documentation-payload/Cazalla/commands/shell.md

@@ -0,0 +1,60 @@
+# shell - Execute Shell Command
+
+Execute arbitrary shell commands on the target system by spawning cmd.exe.
+
+## Description
+
+The `shell` command executes arbitrary shell commands on the target system by spawning cmd.exe. The command is executed in a non-interactive shell and the output is captured and returned. HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions.
+
+## Syntax
+
+```
+shell <command>
+```
+
+## Parameters
+
+- `command` (required): Shell command to execute.
+
+## Examples
+
+```
+shell whoami
+shell dir C:\Users
+shell ipconfig /all
+```
+
+## Features
+
+- The command is executed in a non-interactive shell and the output is captured and returned
+- HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions
+- Command execution and command-line arguments are logged by security tools
+- Consider using built-in Cazalla commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC
+- Always requires approval from another operator before execution
+
+## Output
+
+```
+Microsoft Windows [Version 10.0.19041.1234]
+(c) 2020 Microsoft Corporation. All rights reserved.
+
+C:\Users\Administrator>whoami
+desktop-abc\administrator
+```
+
+## OPSEC Considerations
+
+- **HIGH OPSEC RISK**: Spawns cmd.exe which is heavily monitored
+- Command execution and arguments are logged by EDR/XDR solutions
+- Always requires operator approval (OPSEC pre-check blocks execution)
+- Consider using built-in Cazalla commands instead when possible
+
+## Related
+
+[OPSEC Checking](../../../opsec.md)
+
+---
+
+**Command Category:** System Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1059 - Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)