USB Detection Using WMI Script
USB streak drives are exceptionally normal and can be found in relatively every modernized condition for putting away and exchanging information between PCs. These USB gadgets make it extremely simple for potential aggressor to abuse unprotected PCs with malignant infection and Trojan programming and give a passage to the system for controlling touchy information.
Identifying USB stockpiling gadgets
There are some decent apparatuses that can be found on the net that will inform about USB gadgets on neighborhood and remote windows stages. Yet, a large portion of them are not free and will require an establishment of an operator on the remote windows stages.
WMI notice occasion content
The accompanying USB notice occasion content will send an occasion message in light of any operation of USB gadget on nearby or remote windows stage. For straightforwardness, the content is utilizing a transitory occasion membership, which exists just as long as the content is running. A few changes will be required for a lasting occasion membership that won't require a never-endingly running content:
VBScript (ought to be duplicated and spared as .vbs document):
strComputer = "." '(Any PC name or address)
Set wmi = GetObject("winmgmts:" and strComputer and "rootcimv2")
Set wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent inside 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'")
While True
Set usb = wmiEvent.NextEvent()
Select Case usb.Path_.Class
Case "__InstanceCreationEvent" WScript.Echo("USB gadget found")
Case "__InstanceDeletionEvent" WScript.Echo("USB gadget expelled")
Case "__InstanceModificationEvent" WScript.Echo("USB gadget altered")
End Select
Wend
JScript (ought to be duplicated and spared as .js record):
strComputer = ".";/(Any PC name or address)
var wmi = GetObject("winmgmts:" + strComputer + "rootcimv2");
var wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent inside 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'");
while(true) {
var usb = wmiEvent.NextEvent();
switch (usb.Path_.Class) {
case "__InstanceCreationEvent": {WScript.Echo("USB gadget found"); break;}
case "__InstanceDeletionEvent": {WScript.Echo("USB gadget expelled"); break;}
case "__InstanceModificationEvent": {WScript.Echo("USB gadget altered"); break;}}}
Conclusion
Utilizing the preinstalled Windows Management Instrumentation (WMI) on windows stages is free and won't require any remote operator. It will just require a straightforward content that can be run physically from a favored client account or from another system observing programming like IDS IPS Network Protection and Network Access Control Monitoring system security scanners.
Article Source: http://EzineArticles.com/2502698
Identifying USB stockpiling gadgets
There are some decent apparatuses that can be found on the net that will inform about USB gadgets on neighborhood and remote windows stages. Yet, a large portion of them are not free and will require an establishment of an operator on the remote windows stages.
WMI notice occasion content
The accompanying USB notice occasion content will send an occasion message in light of any operation of USB gadget on nearby or remote windows stage. For straightforwardness, the content is utilizing a transitory occasion membership, which exists just as long as the content is running. A few changes will be required for a lasting occasion membership that won't require a never-endingly running content:
VBScript (ought to be duplicated and spared as .vbs document):
strComputer = "." '(Any PC name or address)
Set wmi = GetObject("winmgmts:" and strComputer and "rootcimv2")
Set wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent inside 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'")
While True
Set usb = wmiEvent.NextEvent()
Select Case usb.Path_.Class
Case "__InstanceCreationEvent" WScript.Echo("USB gadget found")
Case "__InstanceDeletionEvent" WScript.Echo("USB gadget expelled")
Case "__InstanceModificationEvent" WScript.Echo("USB gadget altered")
End Select
Wend
JScript (ought to be duplicated and spared as .js record):
strComputer = ".";/(Any PC name or address)
var wmi = GetObject("winmgmts:" + strComputer + "rootcimv2");
var wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent inside 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'");
while(true) {
var usb = wmiEvent.NextEvent();
switch (usb.Path_.Class) {
case "__InstanceCreationEvent": {WScript.Echo("USB gadget found"); break;}
case "__InstanceDeletionEvent": {WScript.Echo("USB gadget expelled"); break;}
case "__InstanceModificationEvent": {WScript.Echo("USB gadget altered"); break;}}}
Conclusion
Utilizing the preinstalled Windows Management Instrumentation (WMI) on windows stages is free and won't require any remote operator. It will just require a straightforward content that can be run physically from a favored client account or from another system observing programming like IDS IPS Network Protection and Network Access Control Monitoring system security scanners.
Article Source: http://EzineArticles.com/2502698


Comments
Post a Comment