register-cimprovider.exe

WMI file version info (xCyclopedia)

LOLBAS Execute 1 Sigma rule name it 2 ATT&CK techniques 1 documented command 12 known copies with hashes

How register-cimprovider.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-path

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for register-cimprovider.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Load the target .DLL.

Register-cimprovider -path {PATH_ABSOLUTE:.dll}

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for register-cimprovider.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for register-cimprovider.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumDLL Execution Via Register-cimprovider.exeIvan Dyachkov, Yulia Fomina, oscd.community

T1218System Binary Proxy Execution

T1574Hijack Execution Flow

Is it the real register-cimprovider.exe?

file version info and known copies

Original nameRegister-CimProvider2.exe in the file’s header: a renamed copy still carries it

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWMI

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Register-CimProvider.exe · signed by Microsoft Windows

63e3fc6a6755a16b952786e88d9cdc2b2c878d07a929a58520b6000e42c6e1d4

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Register-CimProvider.exe · signed by Microsoft Windows

8b76f4c4e0d1d3a87b0c749a995e3a31cfca2ba88c180c18ba7f169e14c06b60

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Register-CimProvider.exe · signed by Microsoft Windows

5311c4b92bda7852580c8df50922f8328eb5a238012f10ded7b38dc3b9d00d8e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Register-CimProvider.exe · signed by Microsoft Windows

7946dd01fd7a3c2b9f33ecedf6ce04f04d6f494830900338f4469de6464caa0e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Register-CimProvider.exe · signed by Microsoft Windows

d9395667ab0ecb3e2ff40e2e9098ecb0a431db782d70ae222827ee13b9afaa15

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Register-CimProvider.exe · signed by Microsoft Windows

e971bb623a908f47e54ae84bd8c16ffa8d43c0a8cb1eeec104fcefa3119ae32f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Register-CimProvider.exe · signed by Microsoft Windows

088de004b2abc256739060c61b89a4b3eaa892907b0a61ea30c2eb4533add373

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Register-CimProvider.exe · signed by Microsoft Windows

11fc84778b6b88dde720b4b84354a64f3256be6149cd5f558350bb3f5ce8c204

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\Register-CimProvider.exe · signed by Microsoft Windows

08f6185dc43040babf0219914f4af40a0ae18b53f3f979f0c1f729d599644270

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\Register-CimProvider.exe · signed by Microsoft Windows

9cb89f4d7557e1659848e7561ec35a7955e7abf259103bd1bb48bee16cd1c9b5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Register-CimProvider.exe · not signed

31f86c733174cf69af7430cc4e09d833ba531b87ac9fed6b9cdb0736c68483ff

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\Register-CimProvider.exe · not signed

3530a30a2d62f158ccbb9f2af51722f658bbcc179e559ecc06a0cbdf3007871f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.