Skip to content
WMIparser

Glossary

Event consumer (__EventConsumer)

The WMI object that says what to do when a filter fires: run a command line or a script, write a log line, an event log entry or an e-mail.

An event consumer is the what of a WMI event subscription: an instance of a class derived from the system class __EventConsumer. When the event filter it is bound to matches an event, WMI hands the event to the consumer, which performs its action. Windows ships five standard consumer classes in root\subscription:

Why it matters in investigations

Permanent consumers run as SYSTEM and survive reboots. The first two execute arbitrary code, which is why nearly all WMI persistence uses them; the other three can still leak data or be abused, but they do not run a payload by themselves. A consumer acts only when a __FilterToConsumerBinding connects it to a filter, so an unbound consumer is inert, although it still shows what someone prepared or left behind.

Software can also define its own consumer classes. Endpoint agents and management tools do, which is one reason a subscription that is not a Windows default is not automatically malicious. Custom classes are harder to decode without the repository's own class definitions, so collect the whole repository, not only OBJECTS.DATA.

Example

Windows itself installs one consumer on Vista and later, the benign SCM Event Log consumer:

NTEventLogEventConsumer.Name="SCM Event Log Consumer"
    SourceName            = "Service Control Manager"
    NameOfUserSIDProperty = "sid"

It is bound to the SCM Event Log Filter and only writes event log entries. The same name on a different class, such as a CommandLineEventConsumer, would be a red flag.

WMI Parser lists every consumer of a collected repository with its class, properties and bindings. For how the three objects work together, read WMI event subscription persistence explained.