Identifier / Programs / Windows
manage-bde.wsf
LOLBAS Execute 1 ATT&CK technique 2 documented commands
How manage-bde.wsf is abused
Execute T1216 System Script Proxy Execution
cscript
Execute T1216 System Script Proxy Execution
cd
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for manage-bde.wsf.
2 documented commands
Execute T1216 System Script Proxy Execution User privileges
Set the comspec variable to another executable prior to calling manage-bde.wsf for execution.
set comspec={PATH_ABSOLUTE:.exe} & cscript c:\windows\system32\manage-bde.wsfTrips 1 Sigma rule: mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag
Execute T1216 System Script Proxy Execution User privileges
Run the manage-bde.wsf script with a payload named manage-bde.exe in the same directory to run the payload file.
copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsfTrips 1 Sigma rule: mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for manage-bde.wsf, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for manage-bde.wsf. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.