Ages ago, I built the kolide_wmi table to get at WMI data. It uses the WMI query interface, and actually putting it into use requires a lot of weird query work. More and more, I'm seeing the internet provide get-wmiobject based shell snippets. And I wonder, is that a viable path for us?
I don't think we should exec it, but I wonder if there's a better C call we could be doing that looks more like get-wmiobject and less like wmi queries.
Ages ago, I built the
kolide_wmitable to get at WMI data. It uses the WMI query interface, and actually putting it into use requires a lot of weird query work. More and more, I'm seeing the internet provideget-wmiobjectbased shell snippets. And I wonder, is that a viable path for us?I don't think we should exec it, but I wonder if there's a better
Ccall we could be doing that looks more likeget-wmiobjectand less like wmi queries.