CL_Invocation.ps1 — LOLBAS

Execute

ExecutionWindows

Import the PowerShell Diagnostic CL_Invocation script and call SyncInvoke to launch an executable.

Use Proxy execution

. C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1   \nSyncInvoke {CMD}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1216
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_cl_invocation.yml
Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/powershell/powershell_script/posh_ps_cl_invocation_lolscript.yml
Refs: lolbas-project.github.io/lolbas/Scripts/CL_Invocation/