SharpWMI.exe is part of the GhostPack suite of tools that provides WMI functionality, such as local/remote WMI queries, remote WMI process creation, and remote execution of arbitrary VBS through WMI events. The following command will simply list all processes running on the local system.
sharpwmisharpwmiSandbox: execFile · Timeout: 30s
security.execution.wmi Command execution
SharpWMI.exe action=query query="select * from win32_process"SharpWMI.exe is part of the GhostPack suite of tools that provides WMI functionality, such as local/remote WMI queries, remote WMI process creation, and remote execution of arbitrary VBS through WMI events. The following command will simply list all processes running on the local system.
Command Reference:
Get all processes: "select * from win32_process"
SharpWMI.exe action=query query="select * from win32_process"
Services: WMI
Required: Shell