Command and Scripting Interpreter: Windows Command Shell

Description

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.[1] Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Products, Sensors, and Dependencies

ProductDependenciesData sourceAccess requiredProtocolData CollectedNotes
Tenable Vulnerability ManagementAdvanced Network ScanWindows machinesAuthenticated ScanSMBWindows Command Shell policyPlugin ID: 164690

References

Windows Disabled Command Prompt Enumeration

Attack Path Technique Details

Framework: MITRE ATT&CK

Family: Execution

Sub-Technique: Windows Command Shell

Platform: Windows

Tenable Release Date: 2023 Q3