WMI Parser — Blog https://www.wmiparser.com/en/blog Latest from Blog en Tue, 29 Sep 2026 12:45:29 GMT SCCM RecentlyUsedApps: evidence of execution in WMI https://www.wmiparser.com/en/blog/sccm-recentlyusedapps-evidence-of-execution https://www.wmiparser.com/en/blog/sccm-recentlyusedapps-evidence-of-execution Read CCM_RecentlyUsedApps from the WMI repository: which programs each user ran, when last and how often, including older copies carved from OBJECTS.DATA. Florian Amette Tue, 29 Sep 2026 00:00:00 GMT WMI Persistence Investigation Checklist https://www.wmiparser.com/en/blog/wmi-persistence-investigation-checklist https://www.wmiparser.com/en/blog/wmi-persistence-investigation-checklist Step-by-step checklist for WMI persistence: live queries, the repository, event IDs 5860 and 5861, Sysmon 19-21, execution evidence and a safe clean-up. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT SCM Event Log Consumer and BVTConsumer: Benign or Not? https://www.wmiparser.com/en/blog/scm-event-log-consumer-bvtconsumer https://www.wmiparser.com/en/blog/scm-event-log-consumer-bvtconsumer The two WMI subscriptions Windows ships — SCM Event Log and BVTFilter/BVTConsumer — what they contain, why they are harmless, and how attackers can abuse the names. Florian Amette Sat, 26 Sep 2026 00:00:00 GMT Recovering Deleted WMI Persistence From OBJECTS.DATA https://www.wmiparser.com/en/blog/recover-deleted-wmi-persistence https://www.wmiparser.com/en/blog/recover-deleted-wmi-persistence Why deleted WMI filters, consumers and bindings survive in OBJECTS.DATA, how index walking and carving differ, and how python-cim and PyWMIPersistenceFinder compare. Florian Amette Fri, 25 Sep 2026 00:00:00 GMT How to Collect the WMI Repository for Forensics https://www.wmiparser.com/en/blog/collect-wmi-repository https://www.wmiparser.com/en/blog/collect-wmi-repository Where the WMI repository lives and how to copy OBJECTS.DATA, INDEX.BTR and the MAPPING files safely: shadow copy, KAPE WBEM target, Velociraptor or an image. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT Inside OBJECTS.DATA: WMI Repository Forensics https://www.wmiparser.com/en/blog/wmi-repository-objects-data-forensics https://www.wmiparser.com/en/blog/wmi-repository-objects-data-forensics How the WMI CIM repository stores objects: OBJECTS.DATA pages, INDEX.BTR keys, the three MAPPING files, class definitions, instances and name hashes. Florian Amette Wed, 23 Sep 2026 00:00:00 GMT WMI Event Subscription Persistence Explained https://www.wmiparser.com/en/blog/wmi-event-subscription-persistence https://www.wmiparser.com/en/blog/wmi-event-subscription-persistence How WMI event subscription persistence works: __EventFilter, event consumers and __FilterToConsumerBinding, where they are stored and how to find them. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT