LOLBAS. GitHub
LIVING OFF THE LAND / OS SCRIPTS

CL_Mutexverifiers.ps1

View source

Proxy execution with CL_Mutexverifiers.ps1

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1216

Import the PowerShell Diagnostic CL_Mutexverifiers script and call runAfterCancelProcess to launch an executable.

COMMAND
. C:\Windows\diagnostics\system\AERO\CL_Mutexverifiers.ps1   \nrunAfterCancelProcess {PATH:.ps1}
USE CASE
Proxy execution
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · PowerShell
02 / ON DISK

Known paths

C:\Windows\diagnostics\system\WindowsUpdate\CL_Mutexverifiers.ps1
C:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1
C:\Windows\diagnostics\system\WindowsUpdate\CL_Mutexverifiers.ps1
C:\Windows\diagnostics\system\Video\CL_Mutexverifiers.ps1
C:\Windows\diagnostics\system\Speech\CL_Mutexverifiers.ps1
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Pierre-Alexandre Braeken@pabraeken