Skip to content
WMIparser

Glossary

WMI (Windows Management Instrumentation)

Windows' management layer: it exposes system information as classes and instances, answers WQL queries and can run actions when events happen.

Windows Management Instrumentation is Microsoft's implementation of the DMTF's CIM and WBEM standards, built into every modern version of Windows. It exposes the system (processes, services, disks, logons, performance counters, installed software) as classes and instances organised in namespaces, which administrators and programs query with WQL, locally or remotely. The service is Winmgmt; providers that supply live data run in the WMI provider host, WmiPrvSE.exe. PowerShell's Get-CimInstance is today's usual client.

Why it matters in investigations

WMI is an administration tool that attackers use too. Beyond queries, it can react to events through permanent event subscriptions: an event filter says when, an event consumer says what, and a binding links them. Registered once with administrator rights, a subscription survives reboots and runs its action as SYSTEM. MITRE ATT&CK tracks this as T1546.003.

The evidence is stored in the CIM repository, a binary database that autoruns-style reviews and many triage tools overlook. It can be read offline, and it keeps deleted objects until their space is reused. Management products such as the ConfigMgr client also store data there, including evidence of execution.

Example

A subscription in three objects, as found in the WMI Parser sample (fictional host FIN-WKS-07):

__EventFilter             fires about four minutes after each boot (uptime query)
CommandLineEventConsumer  C:\ProgramData\Intel\m64.exe -svc
__FilterToConsumerBinding links the two

Every reboot starts m64.exe as SYSTEM, with no Run key, service or scheduled task involved.

WMI Parser reads a collected WMI repository in the browser, with nothing to install. For the persistence technique in depth, read WMI event subscription persistence explained.