Session/Security Triggers for Commands
Hi,
Is it possible to create sessions/security triggers for when host run commands such as "NET USER "LOGIN" "NEWPASSWORD" ?
Welcome to our community!
Pinned replies
Replies 2
Sean White Team Member
Yes, it is possible, here are a couple of examples to get you started along with a link to our Trigger references, these are both Session Event triggers.
Here is what a Run Command trigger would look like, the RanCommand is processed on the guest side so is technically after the command is queued:
Event.EventType = 'RanCommand' AND Event.Data LIKE '%ipconfig%'
The QueuedCommand event is what the Host does, so the command is Queued and then Run on the guest side.
Event.EventType = 'QueuedCommand' AND Event.Data LIKE '%ipconfig%'
Note that the Event.Data I used a LIKE with surrounding wildcards as the data will contain both the command and the resulting output.
Yes, it is possible, here are a couple of examples to get you started along with a link to our Trigger references, these are both Session Event triggers.
Here is what a Run Command trigger would look like, the RanCommand is processed on the guest side so is technically after the command is queued:
Event.EventType = 'RanCommand' AND Event.Data LIKE '%ipconfig%'
The QueuedCommand event is what the Host does, so the command is Queued and then Run on the guest side.
Event.EventType = 'QueuedCommand' AND Event.Data LIKE '%ipconfig%'
Note that the Event.Data I used a LIKE with surrounding wildcards as the data will contain both the command and the resulting output.
https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Administration_page/Triggers_page/List_of_trigger_definitions