What Is a .BAT File?

BAT files are a classic and persistent attacker technique because they're built into every Windows system — no additional tools required. Common malicious uses: downloading and executing secondary payloads (a BAT file fetches a PowerShell script or EXE from a remote URL using curl or certutil); disabling security controls (using net stop to stop Windows Defender or other security services); creating persistence (adding registry run keys or scheduled tasks that re-execute the BAT file or a payload); lateral movement (using net use and copy commands to push files to network shares); and data collection and exfiltration (enumerating files, reading credentials from registry or files, and sending output to an attacker-controlled location). BAT files are frequently seen in phishing campaigns disguised as invoices, shipping notifications, or IT scripts. Because they're text files, they can be obfuscated using DOS-level tricks — character substitution, variable manipulation, and delayed expansion — to evade signature-based detection while still executing malicious commands. Link to the living off the land attacks and built-in tools pages.