LOLBAS. GitHub
LIVING OFF THE LAND / OS SCRIPTS

CL_Invocation.ps1

View source

Aero diagnostics script

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1216

Import the PowerShell Diagnostic CL_Invocation script and call SyncInvoke to launch an executable.

COMMAND
. C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1   \nSyncInvoke {CMD}
USE CASE
Proxy execution
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · CMD
02 / ON DISK

Known paths

C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1
C:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
C:\Windows\diagnostics\system\WindowsUpdate\CL_Invocation.ps1
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
COMMUNITY RESEARCH

Acknowledgements

Jimmy@bohops
Pierre-Alexandre Braeken@pabraeken