# shell - Execute Shell Command

Execute arbitrary shell commands on the target system by spawning cmd.exe.

## Description

The `shell` command executes arbitrary shell commands on the target system by spawning cmd.exe. The command is executed in a non-interactive shell and the output is captured and returned. HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions.

## Syntax

```
shell <command>
```

## Parameters

- `command` (required): Shell command to execute.

## Examples

```
shell whoami
shell dir C:\Users
shell ipconfig /all
```

## Features

- The command is executed in a non-interactive shell and the output is captured and returned
- HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions
- Command execution and command-line arguments are logged by security tools
- Consider using built-in Cazalla commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC
- Always requires approval from another operator before execution

## Output

```
Microsoft Windows [Version 10.0.19041.1234]
(c) 2020 Microsoft Corporation. All rights reserved.

C:\Users\Administrator>whoami
desktop-abc\administrator
```

## OPSEC Considerations

- **HIGH OPSEC RISK**: Spawns cmd.exe which is heavily monitored
- Command execution and arguments are logged by EDR/XDR solutions
- Always requires operator approval (OPSEC pre-check blocks execution)
- Consider using built-in Cazalla commands instead when possible

## Related

[OPSEC Checking](../../../opsec.md)

---

**Command Category:** System Operations  
**Requires Admin:** No  
**MITRE ATT&CK:** [T1059 - Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)