launcher icon indicating copy to clipboard operation
launcher copied to clipboard

Working with WMI queries is hard, perhaps a `get-wmiobject` approach?

Open directionless opened this issue 1 year ago • 0 comments

Ages ago, I built the kolide_wmi table to get at WMI data. It uses the WMI query interface, and actually putting it into use requires a lot of weird query work. More and more, I'm seeing the internet provide get-wmiobject based shell snippets. And I wonder, is that a viable path for us?

I don't think we should exec it, but I wonder if there's a better C call we could be doing that looks more like get-wmiobject and less like wmi queries.

directionless avatar Oct 25 '24 13:10 directionless