Skip to content
WMIparser

Glossary

__FilterToConsumerBinding

The WMI object that links an event filter to an event consumer. Without it, neither fires; with it, the consumer runs every time the filter matches.

A __FilterToConsumerBinding instance ties an __EventFilter to an event consumer. It is the third object of a WMI event subscription and the one that makes it live: once the binding exists, WMI runs the consumer every time the filter matches. Its Filter and Consumer properties are object paths such as __EventFilter.Name="BVTFilter" and CommandLineEventConsumer.Name="BVTConsumer". It also records a CreatorSID and a few delivery options such as DeliverSynchronously. Like __EventFilter, the class is a system class defined in __SystemClass.

Why it matters in investigations

The binding is what turns two harmless-looking objects into persistence, so it is the natural starting point of a review. A filter or consumer that no binding references is inert; a binding tells you exactly which trigger runs which action. One filter can feed several consumers and one consumer can serve several filters, so an attacker can attach a new consumer to an existing, even default, filter. Count the bindings, not only the objects.

Registering a binding is also what Windows logs: event ID 5861 in Microsoft-Windows-WMI-Activity/Operational, and Sysmon event 21 when Sysmon is configured. Those events date a subscription, which the repository alone cannot do reliably.

Example

The two reference strings of a binding are stored as plain text in the record's heap in OBJECTS.DATA:

__FilterToConsumerBinding
    Filter   = __EventFilter.Name="IntelPerfMonitor"
    Consumer = CommandLineEventConsumer.Name="IntelPerfMonitor"

This is what David Pany's PyWMIPersistenceFinder searches for, and why bindings can be found even after deletion, when only a fragment of the record survives in page slack. The sample in the tool contains such a case: a deleted logon filter and its binding.

WMI Parser starts from the bindings and shows each one with its filter and consumer, live or recovered. For how deleted bindings are found, read recovering deleted WMI persistence.