.. /Pester.bat
Star

Used as part of the Powershell pester

Paths:

c:\Program Files\WindowsPowerShell\Modules\Pester\<version>\bin\Pester.bat

Resources:

Acknowledgements:

Emin Atac (@p0w3rsh3ll)
Stamatis Chatzimangou (@_st0pp3r_)

Detections:

Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml

Execute

Execute code using Pester. The third parameter can be anything. The fourth is the payload. Example here executes notepad
```
Pester.bat [/help|?|-?|/?] "$null; notepad"
```
Use case
Proxy execution

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1216
Execute code using Pester. Example here executes calc.exe
```
Pester.bat ;calc.exe
```
Use case
Proxy execution

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1216
Execute code using Pester. Example here executes calc.exe
```
Pester.bat ;calc.exe
```
Use case
Proxy execution

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1216