Event Log Trigger

WMI can also trigger from Windows event log entries through Win32_NTLogEvent.

Example WQL for a workstation lock event:

SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventCode = '4800'

Event-log triggers can be harder to reason about and should be tested carefully in a lab before use.