marcos.luna
61 lines
1.7 KiB
Markdown
61 lines
1.7 KiB
Markdown
# shell - Execute Shell Command
|
|
|
|
Execute arbitrary shell commands on the target system by spawning cmd.exe.
|
|
|
|
## Description
|
|
|
|
The `shell` command executes arbitrary shell commands on the target system by spawning cmd.exe. The command is executed in a non-interactive shell and the output is captured and returned. HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
shell <command>
|
|
```
|
|
|
|
## Parameters
|
|
|
|
- `command` (required): Shell command to execute.
|
|
|
|
## Examples
|
|
|
|
```
|
|
shell whoami
|
|
shell dir C:\Users
|
|
shell ipconfig /all
|
|
```
|
|
|
|
## Features
|
|
|
|
- The command is executed in a non-interactive shell and the output is captured and returned
|
|
- HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions
|
|
- Command execution and command-line arguments are logged by security tools
|
|
- Consider using built-in Cazalla commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC
|
|
- Always requires approval from another operator before execution
|
|
|
|
## Output
|
|
|
|
```
|
|
Microsoft Windows [Version 10.0.19041.1234]
|
|
(c) 2020 Microsoft Corporation. All rights reserved.
|
|
|
|
C:\Users\Administrator>whoami
|
|
desktop-abc\administrator
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- **HIGH OPSEC RISK**: Spawns cmd.exe which is heavily monitored
|
|
- Command execution and arguments are logged by EDR/XDR solutions
|
|
- Always requires operator approval (OPSEC pre-check blocks execution)
|
|
- Consider using built-in Cazalla commands instead when possible
|
|
|
|
## Related
|
|
|
|
[OPSEC Checking](../../../opsec.md)
|
|
|
|
---
|
|
|
|
**Command Category:** System Operations
|
|
**Requires Admin:** No
|
|
**MITRE ATT&CK:** [T1059 - Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
|