launcher
launcher copied to clipboard
Working with WMI queries is hard, perhaps a `get-wmiobject` approach?
Ages ago, I built the kolide_wmi table to get at WMI data. It uses the WMI query interface, and actually putting it into use requires a lot of weird query work. More and more, I'm seeing the internet provide get-wmiobject based shell snippets. And I wonder, is that a viable path for us?
I don't think we should exec it, but I wonder if there's a better C call we could be doing that looks more like get-wmiobject and less like wmi queries.