query1.ps1

# This query is valid. __InstanceCreationEvent class has TargetInstance property.
$query = @'
SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'cmd.exe'
'@

$evt = Register-CimIndicationEvent -Query $query -SourceIdentifier 'TestEvent' -Action {
    $EventArgs  | Get-Member -Force | Out-Default
    $EventArgs  | Format-List * | Out-Default

    $e = $EventArgs.NewEvent
    $e  | Get-Member -Force | Out-Default
    $e  | Format-List * | Out-Default

    $instance = $e.TargetInstance

    $instance | Get-Member -Force | Out-Default
    $instance | Format-List * | Out-Default
}

$evt
# Unregister-Event -SourceIdentifier 'TestEvent'

query2.ps1

# This query is invalid. Why? CIM_InstCreation has SourceInstance property.
$query = @'
SELECT * FROM CIM_InstCreation WITHIN 1 WHERE SourceInstance ISA 'Win32_Process' AND SourceInstance.Name = 'cmd.exe'
'@

$evt = Register-CimIndicationEvent -Query $query -SourceIdentifier 'TestEvent' -Action {
    $EventArgs  | Get-Member -Force | Out-Default
    $EventArgs  | Format-List * | Out-Default

    $e = $EventArgs.NewEvent
    $e  | Get-Member -Force | Out-Default
    $e  | Format-List * | Out-Default

    $instance = $e.SourceInstance

    $instance | Get-Member -Force | Out-Default
    $instance | Format-List * | Out-Default
}

$evt
# Unregister-Event -SourceIdentifier 'TestEvent'

query3.ps1

# This query is valid. Why? CIM_InstCreation class doesn't have TargetInstance property.
$query = @'
SELECT * FROM CIM_InstCreation WITHIN 1 WHERE SourceInstance ISA 'Win32_Process' AND TargetInstance.Name = 'cmd.exe'
'@

$evt = Register-CimIndicationEvent -Query $query -SourceIdentifier 'TestEvent' -Action {
    $EventArgs  | Get-Member -Force | Out-Default
    $EventArgs  | Format-List * | Out-Default

    $e = $EventArgs.NewEvent
    $e  | Get-Member -Force | Out-Default
    $e  | Format-List * | Out-Default

    $instance = $e.SourceInstance

    $instance | Get-Member -Force | Out-Default
    $instance | Format-List * | Out-Default
}

$evt
# Unregister-Event -SourceIdentifier 'TestEvent'