diff --git a/monkey/infection_monkey/post_breach/actions/collect_processes_list.py b/monkey/infection_monkey/post_breach/actions/collect_processes_list.py
index 5f18e0e33..d0a5c5e0d 100644
--- a/monkey/infection_monkey/post_breach/actions/collect_processes_list.py
+++ b/monkey/infection_monkey/post_breach/actions/collect_processes_list.py
@@ -53,5 +53,5 @@ class ProcessListCollection(PBA):
                 continue
 
         # No command here; used psutil
-        self.pba_data.append(PostBreachData(self.name, "", (processes, success_state)))
+        self.pba_data.append(PostBreachData(self.name, self.command, (processes, success_state)))
         return self.pba_data
diff --git a/monkey/infection_monkey/post_breach/actions/communicate_as_backdoor_user.py b/monkey/infection_monkey/post_breach/actions/communicate_as_backdoor_user.py
index 73ef0fa3b..4dca6ac06 100644
--- a/monkey/infection_monkey/post_breach/actions/communicate_as_backdoor_user.py
+++ b/monkey/infection_monkey/post_breach/actions/communicate_as_backdoor_user.py
@@ -49,16 +49,18 @@ class CommunicateAsBackdoorUser(PBA):
                     )
                 )
                 exit_status = new_user.run_as(http_request_commandline)
-                result = self._get_result_for_telemetry(
+                result = CommunicateAsBackdoorUser._get_result_for_telemetry(
                     exit_status, http_request_commandline, username
                 )
                 # `command` is empty here; we could get the command from `new_user` but that
                 # doesn't work either since Windows doesn't use a command, it uses win32 modules
-                self.pba_data.append(PostBreachData(self.name, "", result))
+                self.pba_data.append(PostBreachData(self.name, self.command, result))
         except subprocess.CalledProcessError as e:
-            self.pba_data.append(PostBreachData(self.name, "", (e.output.decode(), False)))
+            self.pba_data.append(
+                PostBreachData(self.name, self.command, (e.output.decode(), False))
+            )
         except NewUserError as e:
-            self.pba_data.append(PostBreachData(self.name, "", (str(e), False)))
+            self.pba_data.append(PostBreachData(self.name, self.command, (str(e), False)))
         finally:
             return self.pba_data
 
@@ -86,7 +88,8 @@ class CommunicateAsBackdoorUser(PBA):
                 format_string = "wget -O/dev/null -q {url} --method=HEAD --timeout=10"
         return format_string.format(url=url)
 
-    def _get_result_for_telemetry(self, exit_status, commandline, username):
+    @staticmethod
+    def _get_result_for_telemetry(exit_status, commandline, username):
         """
         Parses the result of the command and returns it to be sent as telemetry from the master.
 
diff --git a/monkey/infection_monkey/post_breach/actions/hide_files.py b/monkey/infection_monkey/post_breach/actions/hide_files.py
index 1a2f3472d..e3123192c 100644
--- a/monkey/infection_monkey/post_breach/actions/hide_files.py
+++ b/monkey/infection_monkey/post_breach/actions/hide_files.py
@@ -34,7 +34,7 @@ class HiddenFiles(PBA):
         if is_windows_os():  # use winAPI
             result, status = get_winAPI_to_hide_files()
             # no command here, used WinAPI
-            self.pba_data.append(PostBreachData(self.name, "", (result, status)))
+            self.pba_data.append(PostBreachData(self.name, self.command, (result, status)))
 
         # cleanup hidden files and folders
         cleanup_hidden_files(is_windows_os())
diff --git a/monkey/infection_monkey/post_breach/actions/modify_shell_startup_files.py b/monkey/infection_monkey/post_breach/actions/modify_shell_startup_files.py
index bb1a653f8..5a966e92d 100644
--- a/monkey/infection_monkey/post_breach/actions/modify_shell_startup_files.py
+++ b/monkey/infection_monkey/post_breach/actions/modify_shell_startup_files.py
@@ -29,14 +29,16 @@ class ModifyShellStartupFiles(PBA):
             ]
         # `command` is empty here since multiple commands were run and the results
         # were aggregated to send the telemetry just once
-        self.pba_data.append(PostBreachData(self.name, "", results))
+        self.pba_data.append(PostBreachData(self.name, self.command, results))
         return self.pba_data
 
-    def modify_shell_startup_PBA_list(self):
-        return self.ShellStartupPBAGenerator().get_modify_shell_startup_pbas()
+    @classmethod
+    def modify_shell_startup_PBA_list(cls):
+        return cls.ShellStartupPBAGenerator.get_modify_shell_startup_pbas()
 
     class ShellStartupPBAGenerator:
-        def get_modify_shell_startup_pbas(self):
+        @classmethod
+        def get_modify_shell_startup_pbas(cls):
             (cmds_for_linux, shell_startup_files_for_linux, usernames_for_linux), (
                 cmds_for_windows,
                 shell_startup_files_per_user_for_windows,
@@ -46,14 +48,14 @@ class ModifyShellStartupFiles(PBA):
 
             for startup_file_per_user in shell_startup_files_per_user_for_windows:
                 windows_cmds = " ".join(cmds_for_windows).format(startup_file_per_user)
-                pbas.append(self.ModifyShellStartupFile(linux_cmds="", windows_cmds=windows_cmds))
+                pbas.append(cls.ModifyShellStartupFile(linux_cmds="", windows_cmds=windows_cmds))
 
             for username in usernames_for_linux:
                 for shell_startup_file in shell_startup_files_for_linux:
                     linux_cmds = (
                         " ".join(cmds_for_linux).format(shell_startup_file).format(username)
                     )
-                    pbas.append(self.ModifyShellStartupFile(linux_cmds=linux_cmds, windows_cmds=""))
+                    pbas.append(cls.ModifyShellStartupFile(linux_cmds=linux_cmds, windows_cmds=""))
 
             return pbas
 
diff --git a/monkey/infection_monkey/post_breach/actions/use_signed_scripts.py b/monkey/infection_monkey/post_breach/actions/use_signed_scripts.py
index f6066fecb..75ede03ee 100644
--- a/monkey/infection_monkey/post_breach/actions/use_signed_scripts.py
+++ b/monkey/infection_monkey/post_breach/actions/use_signed_scripts.py
@@ -18,8 +18,8 @@ class SignedScriptProxyExecution(PBA):
         super().__init__(POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC, windows_cmd=" ".join(windows_cmds))
 
     def run(self):
+        original_comspec = ""
         try:
-            original_comspec = ""
             if is_windows_os():
                 original_comspec = subprocess.check_output(  # noqa: DUO116
                     "if defined COMSPEC echo %COMSPEC%", shell=True