WMI Monitor
A PowerShell script that monitors and logs newly created WMI consumers and processes to the Windows Application event log.
What is WMI Monitor?
WMI_Monitor is a PowerShell script that monitors Windows Management Instrumentation (WMI) activity by detecting and logging newly created WMI consumers and processes. It addresses the security challenge of WMI-based attacks by providing visibility into WMI process creation events that are often exploited by malware and threat actors. The tool records these events to the Windows Application event log for security monitoring and forensic analysis.
Windows system administrators, security professionals, and incident responders who need to monitor WMI activity for security threats and malicious behavior on Windows systems.
Developers choose WMI_Monitor because it provides a lightweight, script-based solution specifically focused on WMI security monitoring without requiring complex installations. Its integration with the Windows event log system makes it compatible with existing security monitoring workflows and SIEM solutions.
Overview
Log newly created WMI consumers and processes to the Windows Application event log
Use Cases
Best For
- Detecting WMI-based persistence mechanisms used by malware
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
