title: WMI Event Subscription and PowerShell execution
body: <p>I need to launch a PowerShell script when a certain event happens, and I am using WMI classes to get persistence. I can get it working only partially, and need some help to make it fully working. So, here is what works and what doesn't...</p>
  
  <p>The following code works, and will launch PowerShell in background when calc.exe is launched (I selected this event for simplicity just for testing purposes).</p>
  
  <pre><code>$fname = "testFilter"
  $cname="testConsumer"
  $exePath="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  $query="SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='calc.exe'"
  $WMIEventFilter=Set-WmiInstance -Class __EventFilter -Namespace "root\subscription" -Arguments @{Name=$fname;EventNameSpace="root\cimv2";QueryLanguage="WQL";Query=$query}
  $WMIEventConsumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace "root\subscription" -Arguments @{Name=$cname;ExecutablePath=$exePath}
  Set-WmiInstance -Class __FilterToConsumerBinding -Namespace "root\subscription" -Arguments @{Filter=$WMIEventFilter;Consumer=$WMIEventConsumer} | out-null
  </code></pre>
  
  <p>However, if I modify the <code>$exePath</code> variable to pass arguments to powershell.exe then it doesn't work anymore (no powershell process gets created).</p>
  
  <p>I also tried to replace <code>CommandLineEventConsumer</code> with <code>ActiveScriptEventConsumer</code>, and use a VBScript to launch powershell. Here is the modified code (only line 3 and 5 are different):</p>
  
  <pre><code>$fname = "testFilter"
  $cname="testConsumer"
  $scriptPath="D:\Work\LaunchPowerShell.vbs"
  $query="SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='calc.exe'"
  $WMIEventFilter=Set-WmiInstance -Class __EventFilter -Namespace "root\subscription" -Arguments @{Name=$fname;EventNameSpace="root\cimv2";QueryLanguage="WQL";Query=$query}
  $WMIEventConsumer=Set-WmiInstance -Class ActiveScriptEventConsumer -Namespace "root\subscription" -Arguments @{Name=$cname;ScriptFileName=$scriptPath;ScriptingEngine="VBScript"}
  Set-WmiInstance -Class __FilterToConsumerBinding -Namespace "root\subscription" -Arguments @{Filter=$WMIEventFilter;Consumer=$WMIEventConsumer} | out-null
  </code></pre>
  
  <p>And the LaunchPowerShell.vbs:</p>
  
  <pre><code>Dim objShell : Set objShell = WScript.CreateObject("WScript.shell")
  objShell.run("C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe D:\Work\MyScript.ps1")
  </code></pre>
  
  <p>The VB script works as intended when launched from a command prompt (cmd.exe), but no luck to get powershell running when the event is being triggered (that is, when calc.exe is launched). It won't run even if I remove my script from the powershell arguments, so not sure what the problem is.</p>
  
  <p>If anyone can help that would be much appreciated. Thanks!!!</p>