{
  "name": "wmiExec",
  "display_name": "wmiExec",
  "kind": "module",
  "description": "Execute a command through WMI.",
  "command_template": "wmiExec [--vault {vault:q}] [{auth_mode} {username:q?} {password:q?}] {dc:q?} {target:q} {command:raw}",
  "target": "beacon",
  "requires_session": true,
  "platforms": ["windows"],
  "archs": ["x86", "x64", "arm64"],
  "args": [
    {
      "name": "--vault",
      "type": "credential",
      "required": false,
      "description": "TeamServer vault credential reference. The TeamServer resolves it to DOMAIN\\user and password before dispatch.",
      "credential_filter": {
        "type": "password"
      }
    },
    {
      "name": "auth_mode",
      "type": "enum",
      "required": false,
      "description": "Authentication mode.",
      "values": ["-u", "-k", "-n"]
    },
    {
      "name": "username",
      "type": "text",
      "required": false,
      "description": "DOMAIN\\Username for explicit -u mode."
    },
    {
      "name": "password",
      "type": "text",
      "required": false,
      "description": "Password for -u mode."
    },
    {
      "name": "dc",
      "type": "text",
      "required": false,
      "description": "Domain controller or DOMAIN\\dc value for -k mode."
    },
    {
      "name": "target",
      "type": "text",
      "required": true,
      "description": "Target host name or IP."
    },
    {
      "name": "command",
      "type": "text",
      "required": true,
      "description": "Remote command tail.",
      "variadic": true
    }
  ],
  "examples": [
    "wmiExec --vault cred:credentialId target whoami.exe",
    "wmiExec -u DOMAIN\\Username Password123! target powershell.exe -nop -w hidden",
    "wmiExec -k DOMAIN\\dc target whoami.exe /all",
    "wmiExec -n localhost whoami.exe"
  ],
  "source": "manifest"
}