How to query to look for the creation of a .xls file?

Need a sample query for example that can watch for the origination of
just a .XLS file in WMI.  So far I've come up with this (note, not
entirely my work, cobbled together from websites as I'm still new to
WMI).

SELECT * FROM __InstanceCreationEvent WITHIN 10
 WHERE TargetInstance ISA "CIM_DirectoryContainsFile"
 AND TargetInstance.GroupComponent = "Win32_Directory.Name=\"e:\\\\Test
\""

Now within test can I trigger it to only return .xls files?  Are
wildcards allowed?  Thanks!

Date:Wed, 20 Jun 2007 09:21:41 -0700 Author:

Re: How to query to look for the creation of a .xls file?

This is what you are looking for:

http://www.microsoft.com/technet/scriptcenter/resources/qanda/oct04/hey1011.mspx


-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at 
http://www.microsoft.com/info/cpyright.htm
--
"tekiegreg"  wrote in message 
news:1182356501.802365.206550@p77g2000hsh.googlegroups.com...

> Need a sample query for example that can watch for the origination of
> just a .XLS file in WMI.  So far I've come up with this (note, not
> entirely my work, cobbled together from websites as I'm still new to
> WMI).
>
> SELECT * FROM __InstanceCreationEvent WITHIN 10
> WHERE TargetInstance ISA "CIM_DirectoryContainsFile"
> AND TargetInstance.GroupComponent = "Win32_Directory.Name=\"e:\\\\Test
> \""
>
> Now within test can I trigger it to only return .xls files?  Are
> wildcards allowed?  Thanks!
>

Date:Thu, 21 Jun 2007 12:04:16 -0700 Author: