diff --git a/monkey/infection_monkey/exploit/__init__.py b/monkey/infection_monkey/exploit/__init__.py
index 962240665..95a199923 100644
--- a/monkey/infection_monkey/exploit/__init__.py
+++ b/monkey/infection_monkey/exploit/__init__.py
@@ -25,7 +25,7 @@ class HostExploiter(object):
                               'finished': '',
                               'vulnerable_urls': [],
                               'vulnerable_ports': [],
-                              'executed_cmds': {}}
+                              'executed_cmds': []}
         self._exploit_attempts = []
         self.host = host
 
@@ -59,8 +59,13 @@ class HostExploiter(object):
     def add_vuln_port(self, port):
         self._exploit_info['vulnerable_ports'].append(port)
 
-    def set_example_cmd(self, cmd):
-        self._exploit_info['executed_cmds']['example'] = cmd
+    def add_executed_cmd(self, cmd):
+        """
+        Appends command to exploiter's info.
+        :param cmd: String of executed command. e.g. 'echo Example'
+        """
+        command = {'cmd': cmd}
+        self._exploit_info['executed_cmds'].append(command)
 
 
 from infection_monkey.exploit.win_ms08_067 import Ms08_067_Exploiter
diff --git a/monkey/infection_monkey/exploit/hadoop.py b/monkey/infection_monkey/exploit/hadoop.py
index 39edf0262..ac1cf784a 100644
--- a/monkey/infection_monkey/exploit/hadoop.py
+++ b/monkey/infection_monkey/exploit/hadoop.py
@@ -49,7 +49,7 @@ class HadoopExploiter(WebRCE):
             return False
         http_thread.join(self.DOWNLOAD_TIMEOUT)
         http_thread.stop()
-        self.set_example_cmd(command)
+        self.add_executed_cmd(command)
         return True
 
     def exploit(self, url, command):
diff --git a/monkey/infection_monkey/exploit/mssqlexec.py b/monkey/infection_monkey/exploit/mssqlexec.py
index c1409ec6c..4b5b258b9 100644
--- a/monkey/infection_monkey/exploit/mssqlexec.py
+++ b/monkey/infection_monkey/exploit/mssqlexec.py
@@ -77,7 +77,7 @@ class MSSQLExploiter(HostExploiter):
         commands.extend(monkey_args)
         MSSQLExploiter.execute_command(cursor, commands)
         MSSQLExploiter.run_file(cursor, tmp_file_path)
-        self.set_example_cmd(commands[-1])
+        self.add_executed_cmd(commands[-1])
         return True
 
     @staticmethod
diff --git a/monkey/infection_monkey/exploit/rdpgrinder.py b/monkey/infection_monkey/exploit/rdpgrinder.py
index 828b03c20..ea2bbb3f6 100644
--- a/monkey/infection_monkey/exploit/rdpgrinder.py
+++ b/monkey/infection_monkey/exploit/rdpgrinder.py
@@ -343,5 +343,5 @@ class RdpExploiter(HostExploiter):
 
         LOG.info("Executed monkey '%s' on remote victim %r",
                  os.path.basename(src_path), self.host)
-        self.set_example_cmd(command)
+        self.add_executed_cmd(command)
         return True
diff --git a/monkey/infection_monkey/exploit/shellshock.py b/monkey/infection_monkey/exploit/shellshock.py
index 26e9a743b..5686be5d7 100644
--- a/monkey/infection_monkey/exploit/shellshock.py
+++ b/monkey/infection_monkey/exploit/shellshock.py
@@ -144,7 +144,7 @@ class ShellShockExploiter(HostExploiter):
             if not (self.check_remote_file_exists(url, header, exploit, self._config.monkey_log_path_linux)):
                 LOG.info("Log file does not exist, monkey might not have run")
                 continue
-            self.set_example_cmd(cmdline)
+            self.add_executed_cmd(cmdline)
             return True
 
         return False
diff --git a/monkey/infection_monkey/exploit/sshexec.py b/monkey/infection_monkey/exploit/sshexec.py
index e65d3cb19..e4b7a313c 100644
--- a/monkey/infection_monkey/exploit/sshexec.py
+++ b/monkey/infection_monkey/exploit/sshexec.py
@@ -178,7 +178,7 @@ class SSHExploiter(HostExploiter):
                      self._config.dropper_target_path_linux, self.host, cmdline)
 
             ssh.close()
-            self.set_example_cmd(cmdline)
+            self.add_executed_cmd(cmdline)
             return True
 
         except Exception as exc:
diff --git a/monkey/infection_monkey/exploit/vsftpd.py b/monkey/infection_monkey/exploit/vsftpd.py
index eddac620c..ced79f208 100644
--- a/monkey/infection_monkey/exploit/vsftpd.py
+++ b/monkey/infection_monkey/exploit/vsftpd.py
@@ -138,7 +138,7 @@ class VSFTPDExploiter(HostExploiter):
         if backdoor_socket.send(run_monkey):
             LOG.info("Executed monkey '%s' on remote victim %r (cmdline=%r)", self._config.dropper_target_path_linux,
                      self.host, run_monkey)
-            self.set_example_cmd(run_monkey)
+            self.add_executed_cmd(run_monkey)
             return True
         else:
             return False
diff --git a/monkey/infection_monkey/exploit/web_rce.py b/monkey/infection_monkey/exploit/web_rce.py
index 351eb7c17..d138e4cca 100644
--- a/monkey/infection_monkey/exploit/web_rce.py
+++ b/monkey/infection_monkey/exploit/web_rce.py
@@ -408,7 +408,7 @@ class WebRCE(HostExploiter):
             # If exploiter returns True / False
             if type(resp) is bool:
                 LOG.info("Execution attempt successfully finished")
-                self.set_example_cmd(command)
+                self.add_executed_cmd(command)
                 return resp
             # If exploiter returns command output, we can check for execution errors
             if 'is not recognized' in resp or 'command not found' in resp:
@@ -422,7 +422,7 @@ class WebRCE(HostExploiter):
             return False
         LOG.info("Execution attempt finished")
 
-        self.set_example_cmd(command)
+        self.add_executed_cmd(command)
         return resp
 
     def get_monkey_upload_path(self, url_to_monkey):
diff --git a/monkey/infection_monkey/exploit/wmiexec.py b/monkey/infection_monkey/exploit/wmiexec.py
index 648fb233d..88246ba76 100644
--- a/monkey/infection_monkey/exploit/wmiexec.py
+++ b/monkey/infection_monkey/exploit/wmiexec.py
@@ -114,7 +114,7 @@ class WmiExploiter(HostExploiter):
 
             result.RemRelease()
             wmi_connection.close()
-            self.set_example_cmd(cmdline)
+            self.add_executed_cmd(cmdline)
             return success
 
         return False
diff --git a/monkey/monkey_island/cc/services/attack/attack_report.py b/monkey/monkey_island/cc/services/attack/attack_report.py
index 27fe53392..711f5103a 100644
--- a/monkey/monkey_island/cc/services/attack/attack_report.py
+++ b/monkey/monkey_island/cc/services/attack/attack_report.py
@@ -1,6 +1,5 @@
 import logging
 from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059
-from monkey_island.cc.services.attack.attack_telem import AttackTelemService
 from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.database import mongo
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py
index d30197e9a..bd9e31c92 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1003.py
@@ -13,6 +13,7 @@ class T1003(AttackTechnique):
     used_msg = "Monkey successfully obtained some credentials from systems on the network."
 
     query = {'telem_type': 'system_info_collection', '$and': [{'data.credentials': {'$exists': True}},
+                                                              # $gt: {} checks if field is not an empty object
                                                               {'data.credentials': {'$gt': {}}}]}
 
     @staticmethod
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py
index 6f126b175..5f0fa4433 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1059.py
@@ -13,7 +13,7 @@ class T1059(AttackTechnique):
     used_msg = "Monkey successfully ran commands on exploited machines in the network."
 
     query = [{'$match': {'telem_type': 'exploit',
-                         'data.info.executed_cmds.example': {'$exists': True}}},
+                         'data.info.executed_cmds': {'$exists': True, '$ne': []}}},
              {'$project': {'_id': 0,
                            'machine': '$data.machine',
                            'info': '$data.info'}},
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js
index 5678b8c14..2352772c0 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js
@@ -16,7 +16,7 @@ class T1059 extends React.Component {
       columns: [
         {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.data[0].machine), style: { 'whiteSpace': 'unset'}, width: 160 },
         {Header: 'Approx. Time', id: 'time', accessor: x => x.data[0].info.finished, style: { 'whiteSpace': 'unset' }},
-        {Header: 'Command', id: 'command', accessor: x => x.data[0].info.executed_cmds.example, style: { 'whiteSpace': 'unset' }},
+        {Header: 'Command', id: 'command', accessor: x => x.data[0].info.executed_cmds[0].cmd, style: { 'whiteSpace': 'unset' }},
         ]
     }])};