Run a Remote Windows Command with Invoke-CimMethod

Execute an arbitrary command on a remote Windows host directly through WMI by calling the Win32_Process.Create method over an established CIM session — the simplest agentless remote-exec primitive in PowerShell, riding the same management substrate as wmi-remote-service-execution but without the service lifecycle. MITRE T1047 (Windows Management Instrumentation). ^{1 2}

The pattern

Invoke-CimMethod -CimSession $SESSION_OBJECT `
                 -ClassName Win32_Process `
                 -MethodName Create `
                 -Arguments @{
                      CommandLine = "$SOME_COMMAND"
                  }

$SESSION_OBJECT is a CIM session built beforehand with New-CimSession — see wmi-powershell-sessions for the full credential/session setup (DCOM over TCP 135 + dynamic ports, or WSMan over 5985/5986 as with windows-remote-management). ³

The method returns a ReturnValue (0 = success) and a ProcessId, so you can confirm execution and poll the spawned process with Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = $PID".

Compared to other remote-exec primitives

• vs Win32_Service.Create (wmi-remote-service-execution): Win32_Process.Create is one call with nothing to clean up, but the process runs as the calling user (not SYSTEM), has no console/output capture, and dies if it needs interactive desktop access. Services give you SYSTEM and a controllable lifecycle at the cost of noisier telemetry (EID 4697/7045).
• vs Invoke-Command (PowerShell remoting): works wherever WMI/DCOM is reachable even when WinRM (5985/5986) is blocked or PSRemoting is disabled — the trade-off is no return stream, so results must be exfiltrated (write to a share, callback shell like powershell-reverse-shell, etc.).
• vs the legacy CLI: the deprecated wmic (wmic /node:$HOST process call create "$CMD") is the same Win32_Process.Create call in older tooling.

Operational notes

• Requires local admin on the target (WMI namespace ACLs can loosen this, rarely do) — the same UAC token-filtering gate described in windows-remote-management applies to remote WMI over DCOM.
• No output comes back through the session; pipe results to a file on a reachable share or use a callback.
• Detection: WmiPrvSE.exe spawning the command on the target (Sysmon EID 1), the caller-side script block in PowerShell EID 4104, and DCOM/WinRM network flows — same telemetry story as the rest of the WMI tooling family.

Sources

• Create method of the Win32_Process class — Win32 apps
• Invoke-CimMethod — Microsoft Learn
• Windows Management Instrumentation — MITRE ATT&CK T1047

Related: wmi-powershell-sessions, wmi-remote-service-execution, windows-remote-management, wmic, powershell-run-commands, wmi-remote-scheduled-task

Footnotes

1. Create method of the Win32_Process class — Win32 apps ↩

2. Windows Management Instrumentation — MITRE ATT&CK T1047 ↩

3. Invoke-CimMethod — Microsoft Learn ↩