.. / Invoke-CimMethod

Invokes a method of a CIM class

Functions:	Manage Registry Execute
Type:	Cmdlets
Toolsets:	Builtin CIMSession

Manage

Invoke a method on a CIM instance

Get-CimInstance -Namespace root/CIMV2/TerminalServices -ClassName Win32_TerminalServiceSetting | Invoke-CimMethod -MethodName SetAllowTSConnections -Arguments @{AllowTSConnections=1; ModifyFirewallException=1}

Usecase
Enable Remote Desktop Services

Comments

Create CimSession $s using New-CimSession
PowerShell Module: CimCmdlets

Mitre Att&ck
T1047

Registry

Invoke a static method on a CIM class

Invoke-CimMethod -ClassName StdRegProv -MethodName SetDWORDValue -Arguments @{hDefKey=[uint32]2147483650; sSubKeyName="Software\Policies\Microsoft\Windows NT\Terminal Services"; sValueName="Shadow"; uValue=[uint32]2} -CimSession $s

Usecase
Set registry value

Comments

Create CimSession $s using New-CimSession
PowerShell Module: CimCmdlets

Mitre Att&ck
T1112

Execute

Invoke a static method on a CIM class

Invoke-CimMethod -ClassName Win32_Process -Name Create -Arguments @{CommandLine='C:\Windows\System32\rundll32.exe "C:\tmp\App Folder\beacon.dll",Start'} -CimSession $s

Usecase
Launch implant

Comments

Create CimSession $s using New-CimSession
PowerShell Module: CimCmdlets

Mitre Att&ck
T1047

Updated: 2023-07-01

Contributor: Arris Huijgen (bitsadmin)