How to query to look for the creation of a .xls file?

[tekiegreg]

Need a sample query for example that can watch for the origination of
just a .XLS file in WMI. So far I've come up with this (note, not
entirely my work, cobbled together from websites as I'm still new to
WMI).

SELECT * FROM __InstanceCreationEvent WITHIN 10
WHERE TargetInstance ISA "CIM_DirectoryContainsFile"
AND TargetInstance.GroupComponent = "Win32_Directory.Name=\"e:\\\\Test
\""

Now within test can I trigger it to only return .xls files? Are
wildcards allowed? Thanks!

[Jonathan Liu [MSFT]]

This is what you are looking for:

http://www.microsoft.com/technet/scriptcenter/resources/qanda/oct04/hey1011.mspx
--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
--

Post by tekiegreg
Need a sample query for example that can watch for the origination of
just a .XLS file in WMI. So far I've come up with this (note, not
entirely my work, cobbled together from websites as I'm still new to
WMI).
SELECT * FROM __InstanceCreationEvent WITHIN 10
WHERE TargetInstance ISA "CIM_DirectoryContainsFile"
AND TargetInstance.GroupComponent = "Win32_Directory.Name=\"e:\\\\Test
\""
Now within test can I trigger it to only return .xls files? Are
wildcards allowed? Thanks!