Command and Scripting Interpreter: Windows Command Shell
In this course, you will learn how the native CMD scripting language for Windows can be abused to allow an attacker to execute remote commands, establish persistence and create autorun files to carry out an attack within the Raspberry Robin attack cycle.
Already have an account? Sign In »
Module 1: Introduction
Module 2: What is Technique T1059.003?
2.1Attack, Detect and Mitigate
2.2Raspberry Robin Lab
This course will cover the technique:
T1059.003: Command and Scripting Interpreter: Windows Command Shell. The orchestrator in this whole Raspberry Robin attack cycle is the native Windows command shell or CMD. As you will learn in this course, CMD ensures the autorun scripts are executed once the USB device is plugged into the machine. It is responsible for mounting the USB, initiating the MSI package download, installing, and establishing any future remote C2 connections for the threat actor.
Learn how to detect and mitigate these techniques to protect your organization from this type of attack. Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to tactics and techniques used by threat actors.
Matthew Mullins
Technical Manager, Red Team
Owen Dubiel
Security Engineer
Complete this entire course to earn a Command and Scripting Interpreter: Windows Command Shell Certificate of Completion