cmd

Windows CMD execution T1059.003

Windows Command Processor. Spawning cmd.exe is a common technique for executing commands, creating shells, and chaining operations.

Binary Paths

  • C:\Windows\System32\cmd.exe
  • C:\Windows\SysWOW64\cmd.exe

Glob Patterns

Pattern Wildcards Notes
for /f %i in ('where cm?.exe') do %i /c whoami
? Wildcard replaces 'd'
for /f %i in ('where c*d.exe') do %i
* Star matches 'm'
for /f %i in ('dir /b C:\Windows\System32\cm?.exe') do %i
? dir glob search with wildcard
%COMSPEC%
Environment variable resolves to cmd.exe path — not a glob but a common evasion
for /f %i in ('where cmd*') do %i /c ...
* Star suffix matches cmd.exe

Resources

← Back to Catalog