wmievent's Introduction

WmiEvent

Developed by @jaredcatkinson, @mattifestation

Overview

An Event Filter (__EventFilter) is a WMI Query Language (WQL) query that specifies the type of object to look for (for more details on WQL please check out Ravikanth Chaganti's free ebook). Event Consumers (__EventConsumer) are the action component of the Event Subscription. Event Consumers tell the subscription what to do with an object that makes it past the filter. There are five default event consumers in Windows: ActionScriptEventConsumer (runs arbitrary vbscript or jscript code), CommandLineEventConsumer (executes an arbitrary command), LogFileEventConsumer (writes to a specified flat log file), NtEventLogEventConsumer (creates a new event log), and SMTPEventConsumer (sends an email). Lastly, the Binding (__FilterToConsumerBinding) pairs a Filter with a Consumer.

Cmdlets

Get-ActiveScriptEventConsumer - 
Get-CommandLineEventConsumer - 
Get-LogFileEventConsumer - 
Get-NtEventLogEventConsumer - 
Get-SmtpEventLogEventConsumer - 
Get-WmiEventConsumer - 
Get-WmiEventFilter - 
Get-WmiEventSubscription - 
New-ActiveScriptEventConsumer - 
New-CommandLineEventConsumer - 
New-LogFileEventConsumer - 
New-NtEventLogEventConsumer - 
New-SmtpEventConsumer - 
New-WmiEventConsumer - 
New-WmiEventFilter - 
New-WmiEventSubscription - 
New-CimSessionDcom - 
Register-PermanentWmiEvent -

wmievent's People

Contributors

Stargazers

Watchers

wmievent's Issues

Questions

I am researching using WmiEvent and Uproot but have several questions.

Is there more documentation?
Uproot overview does not have WmiEvent implemented. Are there plans to do so?
If I am already monitoring process creations with the native security log with command-line arguments included, is there any benefit to monitoring them using WMI?
I don't see either tool, by default, monitoring the deletion of a class (defensive monitoring of persistence)? Is this something I would add?

Look forward to the replies.

Thanks in advance. #