Return
-
Title
How do I set up a Response Action to use the Command Prompt to run a command? -
Description
This article guides you through the process of setting up the InTrust Real-Time Monitoring feature 'Response Action' to use a command prompt to execute an action. This article assumes that there is already an InTrust Real-Time Rule set up and configured to respond to a specific event. -
Cause
Some commands are better run through cmd.exe rather than Powershell or a VB Script. The command prompt is generally quicker to respond to a command, so where a time sensitive command must be run, it may be the preferred choice. -
Resolution
- Open InTrust Manager, go down to 'Real-Time Monitoring node | Rules', find and right-click the necessary rule, and select Properties.
- Select the 'Response Actions' tab. Click Add, and select 'Execute command' from the list. Click OK.
- In the 'Working folder:' field, specify the following: c:\
- In the 'Application:' fileld, specify the following: c:\windows\system32\cmd.exe
- In the 'Parameters:' field, specify the following: /C "shutdown /r /f"
The Parameters provided above are configurable depending on the specific action that is trying to be done. The first part, /C, specifies the cmd.exe to run in the background. Using /K instead would result in the cmd.exe to run in the foreground. The command between the quotation marks would be eactly what you would run from the command prompt.
As another example, if you wanted to run a directory search of the C:\ drive, looking for anything ending in dmp (memory dump files), then the following command could be used in the Parameters field: /C "dir /s c:\*.*dmp > c:\output.txt"