Pester.bat

type: OSScripts

Used as part of the Powershell pester

Full path

c:\Program Files\WindowsPowerShell\Modules\Pester\<VERSION>\bin\Pester.bat

Commands

ExecuteUser T1216
Proxy execution
```
Pester.bat [/help|?|-?|/?] "$null; {CMD}"
```
Execute code using Pester. The third parameter can be anything. The fourth is the payload.
os: Windows 10, Windows 11
Execute: EXE
ExecuteUser T1216
Proxy execution
```
Pester.bat ;{PATH:.exe}
```
Execute code using Pester. Example here executes specified executable.
os: Windows 10, Windows 11
Execute: EXE

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml

Resources

acknowledgement: Emin Atac @p0w3rsh3ll, Stamatis Chatzimangou @_st0pp3r_