This site has been deprecated in favor of and will remain in place until 11/1/22.

Command-Line Interface

From attackics
Jump to navigation Jump to search

To visit this technique’s new page please go to and update your links to

Command-Line Interface
ID T0807
Tactic Execution
Data Sources Command: Command Execution, Process: Process Creation, Module: Module Load, Process: Process Creation, Script: Script Execution
Asset Control Server, Data Historian, Field Controller/RTU/PLC/IED, Human-Machine Interface, Input/Output Server


Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands. CLIs provide a means of interacting with computer systems and are a common feature across many types of platforms and devices within control systems environments.1 Adversaries may also use CLIs to install and run new software, including malicious tools that may be installed over the course of an operation.

CLIs are typically accessed locally, but can also be exposed via services, such as SSH, Telnet, and RDP. Commands that are executed in the CLI execute with the current permissions level of the process running the terminal emulator, unless the command specifies a change in permissions context.

Many controllers have CLI interfaces for management purposes.

Procedure Examples

  • Sandworm Team uses the MS-SQL server xp_cmdshell command, and PowerShell to execute commands.2
  • The name of the Industroyer payload DLL is supplied by the attackers via a command line parameter supplied in one of the main backdoor’s “execute a shell command” commands.3
  • Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell with the following command: set @s = ’master..xp _ cmdshell ‘’extrac32 /y “‘+@t+‘” “’+@t+‘x”‘’’; exec(@s);4


  • Execution Prevention - Execution prevention may block malicious software from accessing protected resources through the command line interface.