LOL · Script

CL_Mutexverifiers.ps1

1 techniqueWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Import the PowerShell Diagnostic CL_Mutexverifiers script and call runAfterCancelProcess to launch an executable.

Use Proxy execution

. C:\Windows\diagnostics\system\AERO\CL_Mutexverifiers.ps1   \nrunAfterCancelProcess {PATH:.ps1}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1216
Detection: Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_cl_mutexverifiers.yml
Refs: twitter.com/pabraeken/status/995111125447577600
lolbas-project.github.io/lolbas/Scripts/CL_Mutexverifiers/