WMI process create

wmic /node:<target> /user:<domain>\<user> /password:'<pass>' process call create "cmd.exe /c <payload>"

Creates a process remotely on the target host using WMI (Win32_Process.Create), without leaving temporary services.

When you have administrative credentials over the remote host and want to execute commands with a smaller footprint than PsExec. WMI uses port 135 + dynamic RPC and does not create services: only the child process appears on the target.

If the target host has a firewall blocking WMI (TCP 135) or if you only have access via WinRM (port 5985). Also not if the payload generates highly visible processes: the child process is seen in 4688 with its full command line.