.. / Register Cimprovider

Star

• Execute

Used to register new wmi providers

Paths:

• C:\Windows\System32\Register-cimprovider.exe
• C:\Windows\SysWOW64\Register-cimprovider.exe

• https://twitter.com/PhilipTsukerman/status/992021361106268161

Acknowledgement:

• Philip Tsukerman - @PhilipTsukerman

Detection:

Execute

The LOLBAS can achieve abritrary code execution.

• Load the target .DLL.

  Usecase:Execute code within dll file

  Register-cimprovider -path "C:\folder\evil.dll"

• Privileges required:User
• OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
• Mitre:T1218