windows enabled community high v1.0.0

cl-invocation

Aero diagnostics script Located at: C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1; C:\Windows\diagnostics\system\Audio\CL_Invocation.ps1; C:\Windows\diagnostics\system\WindowsUpdate\CL_Invocation.ps1.

📋 Live Preview 
cl-invocation
cl-invocation

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Import the PowerShell Diagnostic CL_Invocation script and call SyncInvoke to launch an executable. (Proxy execution)

. C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1   \nSyncInvoke {CMD}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_cl_invocation.yml
sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/powershell/powershell_script/posh_ps_cl_invocation_lolscript.yml

Documentation

cl-invocation

cl-invocation is a Windows LOLBin. Aero diagnostics script Located at: C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1; C:\Windows\diagnostics\system\Audio\CL_Invocation.ps1; C:\Windows\diagnostics\system\WindowsUpdate\CL_Invocation.ps1.