windows enabled community high v1.0.0

pester

Used as part of the Powershell pester Located at: c:\Program Files\WindowsPowerShell\Modules\Pester\<VERSION>\bin\Pester.bat.

📋 Live Preview 
pester
pester

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Execute code using Pester. The third parameter can be anything. The fourth is the payload. (Proxy execution)

Pester.bat [/help|?|-?|/?] "$null; {CMD}"

Execute code using Pester. Example here executes specified executable. (Proxy execution)

Pester.bat ;{PATH:.exe}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml

Documentation

pester

pester is a Windows LOLBin. Used as part of the Powershell pester Located at: c:\Program Files\WindowsPowerShell\Modules\Pester<VERSION>\bin\Pester.bat.

References