Skip to content
WMIparser

Glossary

CommandLineEventConsumer

The standard WMI consumer that starts a process: CommandLineTemplate, ExecutablePath and WorkingDirectory, launched as SYSTEM when its filter fires.

CommandLineEventConsumer is the standard WMI event consumer that starts a process when the event filter it is bound to fires. The properties that matter are CommandLineTemplate (the full command line), ExecutablePath (the program, optional when the template names it) and WorkingDirectory; others control the window, the process priority and a KillTimeout. The process is started by the WMI provider host, WmiPrvSE.exe, and runs as SYSTEM. The class is defined in root\subscription and derives from __EventConsumer.

Why it matters in investigations

It is the consumer seen most often in WMI persistence, because it runs anything: a binary dropped in a user-writable folder, an encoded PowerShell command, mshta or rundll32 with a remote payload. Combined with a trigger on boot or logon, it gives an attacker code execution as SYSTEM after every restart, without a Run key, service or scheduled task.

Not every instance is malicious. Windows' own BVTConsumer, found on Windows 7-era images, is a CommandLineEventConsumer that would run cscript KernCap.vbs from C:\tools\kernrate; the script normally does not exist, so nothing runs. Judge each consumer by its content: the command, the paths, the filter it is bound to and its CreatorSID. On the host, processes whose parent is WmiPrvSE.exe are the matching execution evidence.

Example

The consumer in the WMI Parser sample (fictional host FIN-WKS-07), written as MOF:

instance of CommandLineEventConsumer as $Cons
{
    Name = "IntelPerfMonitor";
    CommandLineTemplate = "C:\\ProgramData\\Intel\\m64.exe -svc";
};

Bound to a filter that fires about four minutes after each boot, it starts m64.exe as SYSTEM on every restart. An older copy of the same consumer, recovered from freed space, shows it previously ran an encoded PowerShell command.

Load the sample or your own repository in WMI Parser to see every command-line consumer with its binding. To tell Windows defaults from real findings, read SCM Event Log Consumer and BVTConsumer.