Skip to main content

TACTIC: Execute Command

info
RequirementsLimitationsConsiderations
Endgame installed on the target hostOnly one host can be targeted at a time
The hostname of the target host

TACTIC: Execute Command​

1 - Target the host​

  1. From the Endgame web UI, navigate to the Endpoints tab on the left-hand pane

  2. Find the hostname of interest and click on the respective ENDPOINT NAME to get to the Endpoint Details page

2 - Specifiy the file and arguments to execute​

  1. Click on Take Action -> Respond

  2. Click on the Execute File radio button and fill the following:

    • File Path: C:\Windows\System32\cmd.exe or C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    • Max Time (Seconds): 60 (or more)
    • ☑ Collect Output
    • Arguments: (The commands you want to execute)

  3. Click on Create Response

  4. Verify that the Responses successfully launched message appears and click Close

3 - Verify the response results​

  1. Wait for the Activity Timeline under the Endpoint Details on the left-hand pane to update with a REFRESH LIST notification

  2. Click on the REFRESH LIST notification

  3. Verify that the newest Execute File response entry under the Activity Timeline says Execute File (Success)

NOTE: If the entry says Execute File (Failed), click on the entry to expand the log message to investigate why the response failed

Example Commands​

TARGET: COM Object​

Execute File - (C:\Windows\System32\cmd.exe) Arguments

Replace <DLL_PATH> with the actual filepath to the DLL that you want to unregister:

TACTIC: Unregister DLL​

/C "regsvr32 /u <DLL_PATH>"

TARGET: BITS Job​

Execute File - (C:\Windows\System32\cmd.exe) Arguments

Replace <JOB> with the actual job GUID or display name

TACTIC: Cancel BITS Job​

/C "BITSADMIN /CANCEL <JOB>"

TARGET: Scheduled Task​

Execute File - (C:\Windows\System32\cmd.exe) Arguments

Replace <TASK_NAME> with the actual Scheduled Task name/path:

TACTIC: Disable Scheduled Task​

/C "schtasks /END /TN <TASK_NAME> || schtasks /DISABLE /TN <TASK_NAME>"

TACTIC: Delete Scheduled Task​

/C "schtasks /END /TN <TASK_NAME> || schtasks /DELETE /F /TN <TASK_NAME>"

TARGET: Service​

Execute File - (C:\Windows\System32\cmd.exe) Arguments

Replace <SERVICE_NAME> with the actual Service name:

TACTIC: Delete Service​

/C "net stop <SERVICE_NAME> || sc delete <SERVICE_NAME>"

TACTIC: Disable Service​

/C "net stop <SERVICE_NAME> || sc config <SERVICE_NAME> start= disabled"

TACTIC: Stop Service​

/C "net stop <SERVICE_NAME>"

TARGET: WMI Event Subscription​

Execute File - (C:\Windows\System32\cmd.exe) Arguments

Replace <FILTER_NAME> with the actual WMI Event Filter name, and <CONSUMER_NAME> with the actual WMI Event Consumer name:

TACTIC: Delete Filter+Consumer+Binding​

NOTE: This command assumes that the WMI Event Consumer is of type CommandLineEventConsumer

/C "wmic /namespace:\\root\subscription path __EventFilter where 'Name=\"<FILTER_NAME>\"' delete || wmic /namespace:\\root\subscription path CommandLineEventConsumer where 'Name=\"<CONSUMER_NAME>\"' delete || wmic /namespace:\\root\subscription path __FilterToConsumerBinding where 'Filter=\"Filter=\"\\root\\subscription:__EventFilter.Name=\\\"<FILTER_NAME>\\\"\" and Consumer=\"CommandLineEventConsumer.Name=\\\"<CONSUMER_NAME>\\\"\"' delete"