CmdID

CmdID / PowerShell / Cmdlets / Get

Get-WmiObject

Gets instances of Windows Management Instrumentation (WMI) classes or information about the available classes. PowerShell reference

From the PowerShell reference 18 parameters Alias gwmi 1 Sigma rule looks for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Gets instances of Windows Management Instrumentation (WMI) classes or information about the available classes. Starting in PowerShell 3.0, this cmdlet has been superseded by Get-CimInstance. The Get-WmiObject cmdlet gets instances of WMI classes or information about the available WMI classes. To specify a remote computer, use the ComputerName parameter. If the List parameter is specified, the cmdlet gets information about the WMI classes that are available in a specified namespace. If the Query parameter is specified, the cmdlet runs a WMI query language (WQL) statement. The Get-WmiObject cmdlet does not use Windows PowerShell remoting to perform remote operations. You can use the ComputerName parameter of the Get-WmiObject cmdlet even if your computer does not meet the requirements for Windows PowerShell remoting or is not configured for remoting in Windows PowerShell. Beginning in Windows PowerShell 3.0, the __Server property of the object that Get-WmiObject returns has a PSComputerName alias. This makes it easier to include the source computer name in output and reports.

Get-WmiObject [-Class] <String> [[-Property] <String[]>] [-Filter <String>] [-Amended] [-DirectRead] [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]
Get-WmiObject [[-Class] <String>] [-Recurse] [-Amended] [-List] [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]
Get-WmiObject [-Amended] [-DirectRead] -Query <String> [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]
Get-WmiObject [-Amended] [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]
Get-WmiObject [-Amended] [-AsJob] [-Impersonation <ImpersonationLevel>] [-Authentication <AuthenticationLevel>] [-Locale <String>] [-EnableAllPrivileges] [-Authority <String>] [-Credential <PSCredential>] [-ThrottleLimit <Int32>] [-ComputerName <String[]>] [-Namespace <String>] [<CommonParameters>]

Get processes on the local computer

Get-WmiObject -Class Win32_ProcessIdentify

Gets services on a remote computer

Get-WmiObject -Class Win32_Service -ComputerName 10.1.4.62Identify

Get WMI classes in the root or default namespace of the local computer

Get-WmiObject -Namespace "root/DEFAULT" -ListIdentify

Get a named service on multiple computers

Get-WmiObject -Query "select * from Win32_Service where name='WinRM'" -ComputerName Server01, Server02 | Format-List -Property PSComputerName, Name, ExitCode, Name, ProcessId, StartMode, State, StatusIdentify

Stop a service on a remote computer

(Get-WmiObject -Class Win32_Service -Filter "name='WinRM'" -ComputerName Server01).StopService()Identify

Get the BIOS on the local computer

Get-WmiObject -Class Win32_BIOS | Format-List -Property *Identify

Get the services on a remote computer

Get-WmiObject Win32_Service -Credential FABRIKAM\administrator -ComputerName FabrikamIdentify

Its page in the reference: Get-WmiObject.

Parameters

18 in the PowerShell reference
Show its 18 parameters
-AmendedGets or sets a value that indicates whether the objects that are returned from WMI should contain amended information. Typically, amended information is localizable information, such as object and property descriptions, that is attached to the WMI object.
-AsJobRuns the command as a background job. Use this parameter to run commands that take a long time to finish. When you use the AsJob parameter, the command returns an object that represents the background job and then displays the command prompt. You can continue to work in the session while the job finishes. If Get-WmiObject is used with the ComputerName parameter, the job is created on the local computer, and the results from remote computers are automatically returned to the local computer. To manage the job, use the cmdlets that contain the Job noun. To get the job results, use the Receive-Job cmdlet. For more information about Windows PowerShell background jobs, see about_Jobs and about_Remote_Jobs.
-AuthenticationSpecifies the authentication level to be used with the WMI connection. Valid values are: - -1: Unchanged - 0: Default - 1: None (No authentication in performed.) - 2: Connect (Authentication is performed only when the client establishes a relationship with the application.) - 3: Call (Authentication is performed only at the beginning of each call when the application receives the request.) - 4: Packet (Authentication is performed on all the data that is received from the client.) - 5: PacketIntegrity (All the data that is transferred between the client and the application is authenticated and verified.) - 6: PacketPrivacy (The properties of the other authentication levels are used, and all the data is encrypted.)
-AuthoritySpecifies the authority to use to authenticate the WMI connection. You can specify standard NTLM or Kerberos authentication. To use NTLM, set the authority setting to ntlmdomain:<DomainName>, where <DomainName> identifies a valid NTLM domain name. To use Kerberos, specify kerberos:<DomainName>\<ServerName>. You cannot include the authority setting when you connect to the local computer.
-ClassSpecifies the name of a WMI class. When this parameter is used, the cmdlet retrieves instances of the WMI class.
-ComputerNameSpecifies the target computer for the management operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. The default is the local computer. To specify the local computer, such as in a list of computer names, use localhost, the local computer name, or a dot (.). When specifying a remote computer, your current account or the one you specify with the Credential parameter must have appropriate permissions to access the information. This parameter does not rely on Windows PowerShell remoting, which uses WS-Management. You can use the ComputerName parameter of Get-WmiObject even if your computer is not configured to run WS-Management remote commands.
-CredentialSpecifies a user account that has permission to perform this action. The default is the current user. Type a user name, such as User01, Domain01\User01, or User@Contoso.com. Or, enter a PSCredential object, such as an object that is returned by the Get-Credential cmdlet. When you type a user name, you are prompted for a password. Credentials cannot be used when targeting the local computer.
-DirectReadSpecifies whether direct access to the WMI provider is requested for the specified class without any regard to its base class or to its derived classes.
-EnableAllPrivilegesEnables all the privileges of the current user before the command makes the WMI call.
-FilterSpecifies a Where clause to use as a filter. Uses the syntax of the WMI Query Language (WQL). IMPORTANT: Do not include the Where keyword in the value of the parameter. For example, the following commands return only the logical disks that have a DeviceID of C:\ and services that have the name 'WinRM' without using the Where keyword. Get-WmiObject Win32_LogicalDisk -Filter "DeviceID = 'C:' " Get-WmiObject Win32_Service -Filter "name='WinRM'"
-ImpersonationSpecifies the impersonation level to use. The acceptable values for this parameter are: - 0: Default. Reads the local registry for the default impersonation level. The default is usually set to Impersonate. - 1: Anonymous. Hides the credentials of the caller. - 2: Identify. Allows objects to query the credentials of the caller. - 3: Impersonate. Allows objects to use the credentials of the caller. - 4: Delegate. Allows objects to permit other objects to use the credentials of the caller.
-ListGets the names of the WMI classes in the WMI repository namespace that is specified by the Namespace parameter. If you specify the List parameter, but not the Namespace parameter, Get-WmiObject uses the root/CIMV2 namespace by default. This cmdlet does not use the Default Namespace registry entry in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting registry key to determine the default namespace.
-LocaleSpecifies the preferred locale for WMI objects. Enter a value in MS_<LCID> format.
-NamespaceWhen used with the Class parameter, the Namespace parameter specifies the WMI repository namespace where the specified WMI class is located. When used with the List parameter, it specifies the namespace from which to gather WMI class information.
-PropertySpecifies the WMI class properties that this cmdlet gets information from. Enter the property names.
-QueryRuns the specified WMI Query Language (WQL) statement. This parameter does not support event queries.
-RecurseSearches the current namespace and all other namespaces for the class name that is specified by the Class parameter.
-ThrottleLimitSpecifies the maximum number of WMI operations that can be executed simultaneously. This parameter is valid only when the AsJob parameter is used in the command.

What looks for it

Sigma process creation rules that name Get-WmiObject