Register-cimprovider.exe

type: OSBinaries

Used to register new wmi providers

Full path

C:\Windows\System32\Register-cimprovider.exe
C:\Windows\SysWOW64\Register-cimprovider.exe

Commands

ExecuteUser T1218
Execute code within dll file
```
Register-cimprovider -path {PATH_ABSOLUTE:.dll}
```
Load the target .DLL.
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute: DLL

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_susp_register_cimprovider.yml
IOCRegister-cimprovider.exe execution and cmdline DLL load may be supsicious

Resources

https://twitter.com/PhilipTsukerman/status/992021361106268161

acknowledgement: Philip Tsukerman @PhilipTsukerman