LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Register-cimprovider.exe

View source

Used to register new wmi providers

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Load the target .DLL.

COMMAND
Register-cimprovider -path {PATH_ABSOLUTE:.dll}
USE CASE
Execute code within dll file
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\Windows\System32\Register-cimprovider.exe
C:\Windows\SysWOW64\Register-cimprovider.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Register-cimprovider.exe execution and cmdline DLL load may be supsicious

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Philip Tsukerman@PhilipTsukerman