Pester.bat

~/Privilege Escalation/Windows/Binaries# cat Pester.bat.md █

Used as part of the Powershell pester

Paths:

c:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat
c:\Program Files\WindowsPowerShell\Modules\Pester\.md <b>█<b><div>\bin\Pester.bat

Detection:

Execute

Execute code using Pester. The third parameter can be anything. The fourth is the payload. Example here executes notepad

Pester.bat [/help|?|-?|/?] "$null; notepad"