WMI/WBEM Test Binary Located at: c:\windows\system32\wbem\wbemtest.exe.
wbemtestwbemtestSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Execute arbitary commands through WMI through a GUI managment interface for Web Based Enterprise Management testing (WBEM). Uses WMI to Create and instance of a Win32_Process WMI class with a commandline argument of the target command to spawn. Spawns a GUI so it requires interactive access. For a demo, see link to blog in resources. (Execute arbitrary commands through WMI classes)
wbemtest.exe| Type | Rule / Indicator |
|---|---|
| ioc | wbemtest.exe binary spawned |
wbemtest is a Windows LOLBin. WMI/WBEM Test Binary Located at: c:\windows\system32\wbem\wbemtest.exe.