#WINDOWS 10 COMMAND PROMPT COMMAND LIST HOW TO#
#WINDOWS 10 COMMAND PROMPT COMMAND LIST WINDOWS#

ReconnaissanceĬommands shown in Table 2 are often used to search for confidential information and remote machines within the network. This is presumably how they make sure that the machine is not a sandbox for malware analysis purposes and so on. Table 1: Initial Investigation (Top 10 commands) RankingĪttackers use commands such as “tasklist”, “ver”, “ipconfig” and “systeminfo”, etc., and collect information of the network, process and OS in order to investigate what kind of machine they succeeded in infecting.

#WINDOWS 10 COMMAND PROMPT COMMAND LIST WINDOWS#

“Times executed” is derived from the sum of Windows commands used by 3 different attack groups in their respective C&C servers (Please refer to Appendix A, B and C for details). Table 1 lists the commands that are often used by attackers in an attempt to collect information of the infected machine. Respective Windows commands used in each phase are introduced here below. Windows commands are used in all of the phases above. Spread of infection: Infect the machine with other malware or try to access other machines.Reconnaissance: Look for information saved in the machine and remote machines within the network.Initial investigation: Collect information of the infected machine.With this, attackers can execute Windows commands from a remote environment.Īttackers who successfully installed such malware in a network will attempt to take control of the system within the network in the following sequence in order to collect confidential information, etc. Malware for remote control (Remote Access Tool/Trojan – RAT) has a function to execute shell commands from a remote environment.

#WINDOWS 10 COMMAND PROMPT COMMAND LIST HOW TO#

This entry will demonstrate how to mitigate the attack impact by revealing Windows commands that attackers use on the intruded Windows OS, and by restricting the execution of those commands that are unnecessary for general users. If there is a huge difference, it would be possible to detect or limit the attackers’ behaviour by monitoring/controlling the Windows command execution. What is worth noting here is the gap between those Window commands used by general users and by attackers. On the other hand, JPCERT/CC has observed that attackers intruding into a network also use Windows commands in order to collect information and/or to spread malware infection within the network. However, what is actually used by general users is just a small part of it. In Windows OS, various commands (hereafter “Windows commands”) are installed by default.

Hello again, this is Shusei Tomonaga from the Analysis Center.

Windows 10 command prompt command list