Instantly share code, notes, and snippets.

Embed
What would you like to do?
This permanent WMI event subscription will log any ETW providers removed from the Application event log trace session to the event log.
# Define the signature - i.e. __EventFilter
$EventFilterArgs = @{
EventNamespace = 'ROOT/Microsoft/Windows/EventTracingManagement'
Name = 'ApplicationEventLogProviderRemovalDetection'
Query = 'SELECT * FROM __InstanceDeletionEvent WITHIN 5 WHERE TargetInstance ISA "MSFT_EtwTraceProvider" AND TargetInstance.SessionName = "EventLog-Application"'
QueryLanguage = 'WQL'
}
$InstanceArgs = @{
Namespace = 'root/subscription'
Class = '__EventFilter'
Arguments = $EventFilterArgs
}
$Filter = Set-WmiInstance @InstanceArgs
# Define the event log template and parameters
$Template = @(
'An ETW provider was removed from the Application event log trace session.',
'SessionName: %TargetInstance.SessionName%',
'ETW provider GUID removed: %TargetInstance.Guid%'
)
$NtEventLogArgs = @{
Name = 'ApplicationEventLogProviderRemovalEvent'
Category = [UInt16] 0
EventType = [UInt32] 2 # Warning
EventID = [UInt32] 8
SourceName = 'WSH'
NumberOfInsertionStrings = [UInt32] $Template.Length
InsertionStringTemplates = $Template
}
$InstanceArgs = @{
Namespace = 'root/subscription'
Class = 'NTEventLogEventConsumer'
Arguments = $NtEventLogArgs
}
$Consumer = Set-WmiInstance @InstanceArgs
$FilterConsumerBingingArgs = @{
Filter = $Filter
Consumer = $Consumer
}
$InstanceArgs = @{
Namespace = 'root/subscription'
Class = '__FilterToConsumerBinding'
Arguments = $FilterConsumerBingingArgs
}
# Register the alert
$Binding = Set-WmiInstance @InstanceArgs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment