Managed objects are any logical or physical component or service that can be managed via WMI. This is a process that runs with the display name “Windows Management Instrumentation”, and acts as an intermediary between WMI providers, the WMI repository, and managing applications. 
WMI service is the implementation in Windows of the WMI system. WMI is an integrated part of the Windows operating system, and since Windows 2000 it has come pre-installed with all Windows operating systems. Windows Management Instrumentation Architecture As you can see, the uses of WMI are varied, and the system can be used to monitor and change a huge variety of settings across a computer network. 
Configure computer settings (security, system properties, permissions, etc.)Īll of these functions are accessed via a combination of PowerShell and the WMI command-line interface (WMIC). The large-scale aim of the system is to consolidate the management of devices and applications across corporate networks, and so WMI can be used to do the following: Windows Management Instrumentation Usesīefore we look in more detail at the way that WMI can be used for insider surveillance, it’s also worth pointing out that WMI has plenty of legitimate uses. Towards the end of this post, we’ll explore what that script block might look like for our insider scenario. The above code queries the CIM_DataFile object to obtain Excel file creation details in a specific directory and then fires a script block. Our stealthy insider could put together the following: Register-WmiEvent -Query "SELECT * FROM _InstanceModificationEvent WITHIN 5 WHERE TargetInstance isa 'CIM_DataFile' and TargetInstance.FileSize > 2000000 and TargetInstance.Path = '\\Users\\lex\\Important' and targetInstance.Drive = 'C:’ and targetInstance.Extension =’xlsx’” -Action $action Perhaps our hypothetical insider knows - from say shoulder-surfing - that his colleague Lex occasionally downloads large Excel files containing social security and other account numbers of customers. It doesn’t take that much technical knowledge, and you can imagine a Snowden-like employee turning WMI into an employee monitoring tool. Just as WMI can be used for good, it’s also possible to do some evil insider hacking. The Register-WmiEvent cmdlet does all this through one somewhat complex line of PowerShell. 
With WMI, you can query for, say, all large Excel files found in a directory, and then get notified when a new file meeting a file size criteria of, say, 1 Mb is created. Quick Review: What is WMI and What is it Used For?
Discovering Event Threats with Sysmon and SIEM. Why Use Permanent Events for Surveillance?. Lessons in WMI Eventing and Surveillance.
0 kommentar(er)
