ESET Inspect On-Prem – Table of Contents

WmiPersistenceInfo

Copy current article URL Share via email

This article (PDF) Whole documentation (PDF)

The event is generated when consumer binds to a filter.

Property	Type	Description
EventConsumerName	String	A name of a consumer which triggers an action when a specific event arrives
EventFilterName	String	Name of the used EventFilter
Handler	String	Command line executed by an event consumer
Query	String	A query in an event filter that captures events that should execute an action
TriggeringUserName	String	A name of a user who triggered an event matched by a filter
TriggeringUserSid	String	Triggering the user's security ID
TriggeringUserSidNameUse	Int	Triggering the user's SID type

Example

<rule>
    <definition>
        <operations>
            <operation type="WmiPersistence" >
                <condition component="WmiPersistenceInfo" property="TriggeringUserName" condition="is" value="domain\user.name"/>
            </operation>
        </operations>
    </definition>
    <description>
        <name>WMI Persistence event triggered by user.name</name>
        <category>Default</category>
    </description>
</rule>

Supported operations

•WmiPersistence

˄˅