MSSQL/WMI/PowerShell combined with part 2 to create WMI Monitoring

The WMI consumers of the monitoring types introduced in this paper are mainly CommandLineEventConsumer and LogFileEventConsumer.

For more information, see the following link:

CommandLineEventConsumer

LogFileEventConsumer

Let's take the PowerShell script as an example to show how to create WMI event monitoring

1. LogFileEventConsumer example

1. Create an EventFilter to filter events that need to be monitored

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace} = "root\ subscription"

${ComputerName} = "."

${Query} = "WQL Query Statement"

${Name} = "EventFilter Name"

${NewFilter} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: _ _ EventFilter") .CreateInstance ()

${NewFilter}. {QueryLanguage} = ${QueryLanguage}

${NewFilter}. {Query} = ${Query}

${NewFilter}. {EventNamespace} = ${EventNamespace}

${NewFilter}. {Name} = ${Name}

$result = $NewFilter.Put ()

2. Create a Consumer and trigger the corresponding action

${Text} = 'the text which is to be logged'

${FileName} = "FileName"

${IsUnicode} = "true"

${ComputerName} = "."

${Name} = "EventConsumer Name"

${NewConsumer} = ([wmiclass] "\ ${ComputerName}\ root\ subscription:LogFileEventConsumer") .CreateInstance ()

${NewConsumer}. {Name} = ${Name}

${NewConsumer}. {FileName} = ${FileName}

${NewConsumer}. {IsUnicode} = ${IsUnicode}

${NewConsumer}. {Text} = ${Text}

$NewConsumer.Put ()

3. Create Binding, bind EventFilter and Cousumer, and trigger the action immediately when the event is captured.

${Namespace} = "root\ subscription"

${ComputerName} = "."

${NewBinding} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: _ _ FilterToConsumerBinding") .CreateInstance ()

${NewBinding} .filter = "\\ ${ComputerName}\ ROOT\ Subscription:__EventFilter.Name= `" EventFilter name ""

${NewBinding}. {Consumer} = "\\ ${ComputerName}\ ROOT\ Subscription:LogFileEventConsumer.Name= `" EventConsumer name ""

${NewBinding}. {MaintainSecurityContext} = ${FALSE}

${NewBinding}. {SlowDownProviders} = ${FALSE}

$NewBinding.Put ()

II. CommandLineEventConsumer example

1. Create an EventFilter to filter events that need to be monitored

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace} = "root\ subscription"

${ComputerName} = "."

${Query} = "WQL Query Statement"

${Name} = "EventFilter Name"

${NewFilter} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: _ _ EventFilter") .CreateInstance ()

${NewFilter}. {QueryLanguage} = ${QueryLanguage}

${NewFilter}. {Query} = ${Query}

${NewFilter}. {EventNamespace} = ${EventNamespace}

${NewFilter}. {Name} = ${Name}

$result = $NewFilter.Put ()

2. Create a Consumer and trigger the corresponding action (to execute the PowerShell command behavior example)

${Namespace} = "root\ subscription"

${ComputerName} = "."

${Name} = "EventConsumer Name"

$ExecutablePath= "c:\ xxx\ xxx\ powershell.exe"

$CommandLineTemplate= "powershell.exe-File D:\ xxx\ xxx.ps1"

${NewConsumer} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: CommandLineEventConsumer") .CreateInstance ()

${NewConsumer}. {CommandLineTemplate} = ${CommandLineTemplate}

${NewConsumer}. {ExecutablePath} = ${ExecutablePath}

${NewConsumer}. {name} = ${Name}

$NewConsumer.Put ()

3. Create Binding, bind EventFilter and Cousumer, and trigger the action immediately when the event is captured.

${Namespace} = "root\ subscription"

${ComputerName} = "."

${NewBinding} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: _ _ FilterToConsumerBinding") .CreateInstance ()

${NewBinding} .filter = "\\ ${ComputerName}\ ROOT\ Subscription:__EventFilter.Name= `" EventFilter name ""

${NewBinding}. {Consumer} = "\\ ${ComputerName}\ ROOT\ Subscription:CommandLineEventConsumer.Name= `" EventConsumer name ""

${NewBinding}. {MaintainSecurityContext} = ${FALSE}

${NewBinding}. {SlowDownProviders} = ${FALSE}

$NewBinding.Put ()