Skip to content
WMIparser

Posts tagged: #wmi

← Back to all posts
SCCM RecentlyUsedApps: evidence of execution in WMI
Read CCM_RecentlyUsedApps from the WMI repository: which programs each user ran, when last and how often, including older copies carved from OBJECTS.DATA.
wmisccmevidence-of-executionobjects-data
WMI Persistence Investigation Checklist
Step-by-step checklist for WMI persistence: live queries, the repository, event IDs 5860 and 5861, Sysmon 19-21, execution evidence and a safe clean-up.
wmiincident-responseevent-logspersistence
SCM Event Log Consumer and BVTConsumer: Benign or Not?
The two WMI subscriptions Windows ships — SCM Event Log and BVTFilter/BVTConsumer — what they contain, why they are harmless, and how attackers can abuse the names.
wmipersistencetriagewindows-defaults
Recovering Deleted WMI Persistence From OBJECTS.DATA
Why deleted WMI filters, consumers and bindings survive in OBJECTS.DATA, how index walking and carving differ, and how python-cim and PyWMIPersistenceFinder compare.
wmicarvingobjects-datapersistence
How to Collect the WMI Repository for Forensics
Where the WMI repository lives and how to copy OBJECTS.DATA, INDEX.BTR and the MAPPING files safely: shadow copy, KAPE WBEM target, Velociraptor or an image.
wmiacquisitionkapevelociraptor
Inside OBJECTS.DATA: WMI Repository Forensics
How the WMI CIM repository stores objects: OBJECTS.DATA pages, INDEX.BTR keys, the three MAPPING files, class definitions, instances and name hashes.
wmicim-repositoryobjects-datadfir
WMI Event Subscription Persistence Explained
How WMI event subscription persistence works: __EventFilter, event consumers and __FilterToConsumerBinding, where they are stored and how to find them.
wmipersistencedfirt1546-003