wbemtest.exe

type: OSBinaries

WMI/WBEM Test Binary

Full path

c:\windows\system32\wbem\wbemtest.exe

Commands

ExecuteAny T1047
Execute arbitrary commands through WMI classes
```
wbemtest.exe
```
Execute arbitary commands through WMI through a GUI managment interface for Web Based Enterprise Management testing (WBEM). Uses WMI to Create and instance of a Win32_Process WMI class with a commandline argument of the target command to spawn. Spawns a GUI so it requires interactive access. For a demo, see link to blog in resources.
os: Windows 10, Windows 11
Application: GUIExecute: CMD

Detection

IOCwbemtest.exe binary spawned

Resources

https://saulpanders.github.io/2025/01/20/lolbas-wbemtest.html

acknowledgement: Paul Sanders @saulpanders