Skip to content
WMIparser

Glossary

WMI namespace (root\subscription)

A folder-like container of WMI classes and instances, such as root\cimv2. Permanent event subscriptions normally live in root\subscription.

A WMI namespace groups classes and instances, the way a folder groups files. Namespaces form a tree under root, and every WMI object belongs to exactly one of them. A few matter most in investigations:

  • root\cimv2 holds the Win32 classes (processes, services, disks, logons) and is the usual source of events.
  • root\subscription holds the standard event consumer classes and, normally, the permanent event subscriptions.
  • root\default is another place where subscriptions are sometimes registered.
  • root\ccm\SoftwareMeteringAgent exists only with the ConfigMgr client and holds CCM_RecentlyUsedApps.

System classes such as __EventFilter and __FilterToConsumerBinding are defined in __SystemClass, and each namespace lists its child namespaces as __NAMESPACE instances.

Why it matters in investigations

A subscription does not have to live in root\subscription to work. An __EventFilter names the namespace it watches in its EventNamespace property, so a filter, consumer and binding registered in root\cimv2 or root\default can still watch events in root\cimv2. Live queries that look only at root\subscription miss them; check every namespace, or parse the whole repository.

In the CIM repository, namespace names appear only as hashes in INDEX.BTR keys (NS_<hash>); readable names are rebuilt by walking __NAMESPACE instances from root. Records carved from OBJECTS.DATA do not say which namespace they came from, so a recovered binding may have lived anywhere.

Example

Listing subscription objects across the usual namespaces on a live host:

'root/subscription','root/cimv2','root/default' | ForEach-Object {
  Get-CimInstance -Namespace $_ -ClassName __FilterToConsumerBinding -ErrorAction SilentlyContinue
}

This shows only live objects and relies on the WMI service of a possibly compromised host, so use it for triage and parse the collected repository as well.

WMI Parser reports the namespace of every object found through the index. For what to check beyond root\subscription, see the WMI persistence investigation checklist.