ESET Inspect On-Prem – Table of Contents

WmiQueryInfo

Copy current article URL Share via email

This article (PDF) Whole documentation (PDF)

WMI query events occur when a user or a service trigger a query on a system.

Property	Type	Description
ClientMachineFQDN	String	Fully qualified domain name of the client machine
IsLocal	Bool	If false, a query was called from a remote machine (for example, using WbemTest)
Query	String	A query was triggered in a system

Example

<?xml version="1.0" encoding="utf-8"?>
<rule>
    <definition>
        <operations>
            <operation type="WmiQuery">
                <condition component="WmiQueryInfo" property="Query" condition="contains" value="win32_service" />
            </operation>
        </operations>
    </definition>
    <description>
        <name>Example WMI query event</name>
        <explanation>
            This tag supports markdown and html syntax.
            It is also true for maliciousCauses, benignCauses and recommendedActions tags.
        </explanation>
        <maliciousCauses>

Content of tags with HTML text must be surrounded with CDATA xml tag.

        </maliciousCauses>
        <category>
            Default
        </category>
    </description>
</rule>

Supported operations

•WmiQuery

˄˅