USB Detection Using WMI Script

USB streak drives are exceptionally normal and can be found in relatively every modernized condition for putting away and exchanging information between PCs. These USB gadgets make it extremely simple for potential aggressor to abuse unprotected PCs with malignant infection and Trojan programming and give a passage to the system for controlling touchy information.

Identifying USB stockpiling gadgets

There are some decent apparatuses that can be found on the net that will inform about USB gadgets on neighborhood and remote windows stages. Yet, a large portion of them are not free and will require an establishment of an operator on the remote windows stages.

WMI notice occasion content

The accompanying USB notice occasion content will send an occasion message in light of any operation of USB gadget on nearby or remote windows stage. For straightforwardness, the content is utilizing a transitory occasion membership, which exists just as long as the content is running. A few changes will be required for a lasting occasion membership that won't require a never-endingly running content:

VBScript (ought to be duplicated and spared as .vbs document):

strComputer = "." '(Any PC name or address)

Set wmi = GetObject("winmgmts:" and strComputer and "rootcimv2")

Set wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent inside 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'")

While True

Set usb = wmiEvent.NextEvent()

Select Case usb.Path_.Class

Case "__InstanceCreationEvent" WScript.Echo("USB gadget found")

Case "__InstanceDeletionEvent" WScript.Echo("USB gadget expelled")

Case "__InstanceModificationEvent" WScript.Echo("USB gadget altered")

End Select

Wend

JScript (ought to be duplicated and spared as .js record):

strComputer = ".";/(Any PC name or address)

var wmi = GetObject("winmgmts:" + strComputer + "rootcimv2");

var wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent inside 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'");

while(true) {

var usb = wmiEvent.NextEvent();

switch (usb.Path_.Class) {

case "__InstanceCreationEvent": {WScript.Echo("USB gadget found"); break;}

case "__InstanceDeletionEvent": {WScript.Echo("USB gadget expelled"); break;}

case "__InstanceModificationEvent": {WScript.Echo("USB gadget altered"); break;}}}

Conclusion

Utilizing the preinstalled Windows Management Instrumentation (WMI) on windows stages is free and won't require any remote operator. It will just require a straightforward content that can be run physically from a favored client account or from another system observing programming like IDS IPS Network Protection and Network Access Control Monitoring system security scanners.

Article Source: http://EzineArticles.com/2502698

Comments

Popular posts from this blog

Digital Electronics & Its Advantages And Disadvantages

Apple Watch 3: Time For a New Calling

Different World Views of Art