Skip to content

Instantly share code, notes, and snippets.

@Katzenwerfer

Katzenwerfer/OnTaskTermination.xml

Created January 7, 2023 05:04
Show Gist options
  • Save Katzenwerfer/982ac99ca4e2cca3050e8ef3593e514d to your computer and use it in GitHub Desktop.
Save Katzenwerfer/982ac99ca4e2cca3050e8ef3593e514d to your computer and use it in GitHub Desktop.
Download ZIP
An event filter for tasks to run when a specific process is terminated.
Raw
OnTaskTermination.xml
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task = 13313 and (EventID=4689)]] and *[EventData[Data[@Name='ProcessName'] and (Data='C:\PATH\TO\EXECUTABLE.exe')]]
</Select>
</Query>
</QueryList>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment