Win32_PhysicalMemory: Event-Driven Monitoring (WQL __InstanceCreationEvent)

<#
.SYNOPSIS
    WQL reference: event-driven monitoring for new Win32_PhysicalMemory instances.

.DESCRIPTION
    WQL supports event queries against WMI's built-in event classes, not
    just static SELECT against data classes. This query fires whenever a
    new Win32_PhysicalMemory instance is created, checked via a 2-second polling
    interval — useful for near-real-time monitoring.

.EXAMPLE
    .\PhysicalMemoryEventQuery.ps1
    Runs until Ctrl+C.
#>

[CmdletBinding()]
param()

$wqlQuery = "SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_PhysicalMemory'"
$sourceId = "PhysicalMemoryWatch"

Write-Host "Watching for new Win32_PhysicalMemory instances (Ctrl+C to stop)..." -ForegroundColor Cyan
Write-Host "WQL: $wqlQuery" -ForegroundColor DarkGray

Register-CimIndicationEvent -Query $wqlQuery -SourceIdentifier $sourceId -Action {
    $created = $Event.SourceEventArgs.NewEvent.TargetInstance
    Write-Host "$(Get-Date -Format 'HH:mm:ss') New Win32_PhysicalMemory: $($created.BankLabel)"
} | Out-Null

try {
    Wait-Event -SourceIdentifier $sourceId | Out-Null
} finally {
    Unregister-Event -SourceIdentifier $sourceId -ErrorAction SilentlyContinue
}