Create your own WMI CIM class. Compile with MOFCOMP.exe. Needs local admin. Good for when you have app whitelisting or can’t write to disk or transfer via SMB and need SYSTEM.
Managed Object Format (MOF) - Win32 apps
mofcomp.exe -B: payload.bin.mof payload.mof
mofcomp.exe payload.mof
Or remotely:
mofcomp.exe -N:\\<COMPUTER>\<NAMESPACE> -A:NTLMDOMAIN:<DOMAIN> - U:<USERNAME> -P:<PASSWORD> payload.mof
Can use anything that can be converted to jscript