wbemtest.exe

WMI/WBEM Test Binary

Paths

  • c:\windows\system32\wbem\wbemtest.exe

Commands

Execute

Execute arbitary commands through WMI through a GUI managment interface for Web Based Enterprise Management testing (WBEM). Uses WMI to Create and instance of a Win32_Process WMI class with a commandline argument of the target command to spawn. Spawns a GUI so it requires interactive access. For a demo, see link to blog in resources.

Use case: Execute arbitrary commands through WMI classes

Privileges: Any

wbemtest.exe

Detection

Resources