WmiQueryInfo

WMI query events occur when a user or a service trigger a query on a system.

Property	Type	Description
ClientMachineFQDN	String	Fully qualified domain name of the client machine
IsLocal	Bool	If false, a query was called from a remote machine (for example, using WbemTest)
Query	String	A query was triggered in a system

Example

<?xml version="1.0" encoding="utf-8"?>

<rule>

</operation>

</operations>

</definition>

<name>Example WMI query event</name>

This tag supports markdown and html syntax.

It is also true for maliciousCauses, benignCauses and recommendedActions tags.

</explanation>

Content of tags with HTML text must be surrounded with CDATA xml tag.

</maliciousCauses>

Default

</category>

</description>

</rule>

•WmiQuery

˄˅