It has leveraged xp_cmdshell and Windows Command Shell to execute commands on a compromised machine. It has also attempted to leverage the ‘xp_cmdshell’ SQL procedure to execute remote commands on internal MS-SQL servers.