Shulou(Shulou.com)06/03 Report--

The WMI consumers of the monitoring types introduced in this paper are mainly CommandLineEventConsumer and LogFileEventConsumer.

For more information, see the following link:

CommandLineEventConsumer

LogFileEventConsumer

Let's take the PowerShell script as an example to show how to create WMI event monitoring

1. LogFileEventConsumer example

1. Create an EventFilter to filter events that need to be monitored

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace} = "root\ subscription"

${ComputerName} = "."

${Query} = "WQL Query Statement"

${Name} = "EventFilter Name"

${NewFilter} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: _ _ EventFilter") .CreateInstance ()

${NewFilter}. {QueryLanguage} = ${QueryLanguage}

${NewFilter}. {Query} = ${Query}

${NewFilter}. {EventNamespace} = ${EventNamespace}

${NewFilter}. {Name} = ${Name}

$result = $NewFilter.Put ()

2. Create a Consumer and trigger the corresponding action

${Text} = 'the text which is to be logged'

${FileName} = "FileName"

${IsUnicode} = "true"

${ComputerName} = "."

${Name} = "EventConsumer Name"

${NewConsumer} = ([wmiclass] "\ ${ComputerName}\ root\ subscription:LogFileEventConsumer") .CreateInstance ()

${NewConsumer}. {Name} = ${Name}

${NewConsumer}. {FileName} = ${FileName}

${NewConsumer}. {IsUnicode} = ${IsUnicode}

${NewConsumer}. {Text} = ${Text}

$NewConsumer.Put ()

3. Create Binding, bind EventFilter and Cousumer, and trigger the action immediately when the event is captured.

${Namespace} = "root\ subscription"

${ComputerName} = "."

${NewBinding} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: _ _ FilterToConsumerBinding") .CreateInstance ()

${NewBinding} .filter = "\\ ${ComputerName}\ ROOT\ Subscription:__EventFilter.Name= `" EventFilter name ""

${NewBinding}. {Consumer} = "\\ ${ComputerName}\ ROOT\ Subscription:LogFileEventConsumer.Name= `" EventConsumer name ""

${NewBinding}. {MaintainSecurityContext} = ${FALSE}

${NewBinding}. {SlowDownProviders} = ${FALSE}

$NewBinding.Put ()

II. CommandLineEventConsumer example

1. Create an EventFilter to filter events that need to be monitored

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace} = "root\ subscription"

${ComputerName} = "."

${Query} = "WQL Query Statement"

${Name} = "EventFilter Name"

${NewFilter} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: _ _ EventFilter") .CreateInstance ()

${NewFilter}. {QueryLanguage} = ${QueryLanguage}

${NewFilter}. {Query} = ${Query}

${NewFilter}. {EventNamespace} = ${EventNamespace}

${NewFilter}. {Name} = ${Name}

$result = $NewFilter.Put ()

2. Create a Consumer and trigger the corresponding action (to execute the PowerShell command behavior example)

${Namespace} = "root\ subscription"

${ComputerName} = "."

${Name} = "EventConsumer Name"

$ExecutablePath= "c:\ xxx\ xxx\ powershell.exe"

$CommandLineTemplate= "powershell.exe-File D:\ xxx\ xxx.ps1"

${NewConsumer} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: CommandLineEventConsumer") .CreateInstance ()

${NewConsumer}. {CommandLineTemplate} = ${CommandLineTemplate}

${NewConsumer}. {ExecutablePath} = ${ExecutablePath}

${NewConsumer}. {name} = ${Name}

$NewConsumer.Put ()

3. Create Binding, bind EventFilter and Cousumer, and trigger the action immediately when the event is captured.

${Namespace} = "root\ subscription"

${ComputerName} = "."

${NewBinding} = ([wmiclass] "\ ${ComputerName}\ ${Namespace}: _ _ FilterToConsumerBinding") .CreateInstance ()

${NewBinding} .filter = "\\ ${ComputerName}\ ROOT\ Subscription:__EventFilter.Name= `" EventFilter name ""

${NewBinding}. {Consumer} = "\\ ${ComputerName}\ ROOT\ Subscription:CommandLineEventConsumer.Name= `" EventConsumer name ""

${NewBinding}. {MaintainSecurityContext} = ${FALSE}

${NewBinding}. {SlowDownProviders} = ${FALSE}

$NewBinding.Put ()

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.