Catalog LOLBAS

LOL · Binary

wbemtest.exe

1 technique WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Execute arbitary commands through WMI through a GUI managment interface for Web Based Enterprise Management testing (WBEM). Uses WMI to Create and instance of a Win32_Process WMI class with a commandline argument of the target command to spawn. Spawns a GUI so it requires interactive access. For a demo, see link to blog in resources.

Use Execute arbitrary commands through WMI classes

wbemtest.exe
Context
user
Native
Execute
MITRE
T1047
Detection
IOC: wbemtest.exe binary spawned