Skip to content
WMIparser

Glossary

WMI (Windows Management Instrumentation)

Windows' management layer: it exposes system information as classes and instances, answers WQL queries and can run actions when events happen.

Windows Management Instrumentation is Microsoft's implementation of the CIM and WBEM standards. It exposes the system — processes, services, disks, logons, performance counters — as classes and instances in namespaces, queried with WQL.

Beyond queries, WMI can react to events through permanent subscriptions (a filter, a consumer and a binding), which is why it appears in persistence investigations. Its data lives in the CIM repository. See WMI event subscription persistence explained.