Register-cimprovider.exe

Load the target .DLL.

Use Execute code within dll file

Register-cimprovider -path {PATH_ABSOLUTE:.dll}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_susp_register_cimprovider.yml

IOC: Register-cimprovider.exe execution and cmdline DLL load may be supsicious

Refs

twitter.com/PhilipTsukerman/status/992021361106268161

lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/