Glossary
__EventFilter
The WMI class that describes the trigger of an event subscription: a named WQL query, its language and the namespace it watches.
An __EventFilter instance is the when of a WMI event subscription. It is a named WQL event query: WMI evaluates it continuously and, each time an event matches, delivers that event to every event consumer bound to the filter. Its properties are Name, Query, QueryLanguage (always WQL in practice), EventNamespace (the namespace whose events are watched, usually root\cimv2), EventAccess and CreatorSID. The class itself is a system class, defined in __SystemClass.
Why it matters in investigations
The query tells you when the payload runs, which drives the rest of the timeline. Filters used for persistence often watch system uptime (so the action runs shortly after every boot), user logons, the start of a given process, a device insertion or a WMI timer. CreatorSID records the account that registered the filter.
A filter alone does nothing: it acts only when a __FilterToConsumerBinding links it to a consumer. Attackers sometimes bind their own consumer to an existing filter, including a default one, so count the bindings that reference each filter rather than judging the filter by its name.
Example
The classic uptime trigger, from the WMI Parser sample:
SELECT * FROM __InstanceModificationEvent WITHIN 60
WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'
AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325
WMI polls the performance class every 60 seconds and fires when uptime falls between 240 and 325 seconds: about four minutes after each boot. With EventNamespace set to root\cimv2, this filter works even when it is registered in root\subscription, which is where persistence filters normally live.
Related terms
WMI Parser shows each filter's query next to the consumer it triggers. For the complete picture, read WMI event subscription persistence explained.