Skip to content

Instantly share code, notes, and snippets.

@et0x
Last active May 27, 2017 01:26
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save et0x/7049545a3022879f7bffa3e4e44eeb6b to your computer and use it in GitHub Desktop.
Save et0x/7049545a3022879f7bffa3e4e44eeb6b to your computer and use it in GitHub Desktop.
List all WMI extrinsic event classes recursively
function Get-Derived {
Param(
[String]$Class,
[String]$Namespace
)
if (-not [string]::IsNullOrEmpty($Class))
{
Get-WmiObject -List -Namespace $Namespace | Where-Object { $_.__SUPERCLASS -eq $Class -and (-not ($_.Name.StartsWith('__')) ) } | foreach {
Get-Derived -Class $_.__CLASS -Namespace $_.__NAMESPACE
$_
}
}
}
function Get-ExtrinsicEvents
{
$namespaces = Get-WmiObject -Namespace 'root' -Class '__Namespace' -Recurse | Select-Object @{N='Name';E={"root/$($_.Name)"}}
$extrinsic = $namespaces.Name | foreach { $ns = $_; Get-WmiObject -List -namespace $_ | Where-Object { ($_.__SUPERCLASS -eq '__ExtrinsicEvent') -and -not ( ($_.Name).StartsWith('__')) } }
$extrinsic | foreach {
$_
Get-Derived -Class ($_.Name) -Namespace ($_.__NAMESPACE)
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment