Ceplin Command Identifier

Identifier / Programs / Windows

pester.bat

LOLBAS Execute 1 ATT&CK technique 2 documented commands

Opens the identifier with your command. It is read in your browser and sent nowhere.

How pester.bat is abused

documented by LOLBAS

Execute T1216 System Script Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for pester.bat.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1216 System Script Proxy Execution User privileges

Execute code using Pester. The third parameter can be anything. The fourth is the payload.

Pester.bat [/help|?|-?|/?] "$null; {CMD}"
Identify

Execute T1216 System Script Proxy Execution User privileges

Execute code using Pester. Example here executes specified executable.

Pester.bat ;{PATH:.exe}
Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for pester.bat, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for pester.bat. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
T1216System Script Proxy Execution

Other programs abused for Execute

acccheckconsole.exe · addinutil.exe · adplus.exe · advpack.dll · agentexecutor.exe · appcert.exe · applauncher.exe · appvlp.exe · at.exe · atbroker.exe · bash.exe · bginfo.exe · bitsadmin.exe · cdb.exe · certoc.exe · change.exe