CIM repository (WMI repository)

The CIM repository, also called the WMI repository, is the persistent store of WMI. It lives in C:\Windows\System32\wbem\Repository on Windows Vista and later (Repository\FS on Windows XP and Server 2003) and holds the class definitions and static instances of every namespace, including permanent event subscriptions and data written by software such as the ConfigMgr client.

It is a small page-based database made of five files: OBJECTS.DATA holds the records, INDEX.BTR is a B-tree index over them, and the three MAPPING files translate logical page numbers into physical ones. Microsoft does not document this container; its layout was reverse-engineered by FireEye in 2015 (python-cim, part of flare-wmi), while the encoding of each object follows Microsoft's public MS-WMIO specification.

Why it matters in investigations

Every event filter, consumer and binding of a WMI persistence is stored here, so the repository is the primary evidence for MITRE ATT&CK T1546.003. It can be read offline, without trusting the WMI service of a possibly compromised host, and it keeps more than a live query shows: deleted and older versions of objects stay in freed pages until WMI reuses the space.

That makes collection order important. Do not stop the WMI service or rebuild the repository before copying it, and take all five files from the same instant, ideally from a volume shadow copy. An index or map from another moment points to the wrong pages.

Example

A typical collected folder:

C:\Windows\System32\wbem\Repository\
    INDEX.BTR
    MAPPING1.MAP
    MAPPING2.MAP
    MAPPING3.MAP
    OBJECTS.DATA

After an in-place upgrade, check C:\Windows.old\Windows\System32\wbem\Repository as well.

Drop the folder on WMI Parser to read it in the browser. For the file format in depth, read Inside OBJECTS.DATA; for acquisition, see how to collect the WMI repository.

Why it matters in investigations

Example

Related terms