Skip to content
WMIparser

Series

Investigating WMI persistence

4 posts in this series. Read them in order or jump to any one.

  1. Recovering Deleted WMI Persistence From OBJECTS.DATA

    Why deleted WMI filters, consumers and bindings survive in OBJECTS.DATA, how index walking and carving differ, and python-cim vs PyWMIPersistenceFinder.

  2. SCM Event Log Consumer and BVTConsumer: Benign or Not?

    The two WMI subscriptions Windows ships (SCM Event Log, BVTFilter/BVTConsumer): what they contain, why they are harmless, how attackers can abuse the names.

  3. WMI Persistence Investigation Checklist

    Step-by-step checklist for WMI persistence: live queries, the repository, event IDs 5860 and 5861, Sysmon 19-21, execution evidence and a safe clean-up.

  4. SCCM RecentlyUsedApps: evidence of execution in WMI

    Read CCM_RecentlyUsedApps from the WMI repository: which programs each user ran, when last and how often, including older copies carved from OBJECTS.DATA.

All posts in this series

Recovering Deleted WMI Persistence From OBJECTS.DATA
Why deleted WMI filters, consumers and bindings survive in OBJECTS.DATA, how index walking and carving differ, and python-cim vs PyWMIPersistenceFinder.
wmicarvingobjects-datapersistence
SCM Event Log Consumer and BVTConsumer: Benign or Not?
The two WMI subscriptions Windows ships (SCM Event Log, BVTFilter/BVTConsumer): what they contain, why they are harmless, how attackers can abuse the names.
wmipersistencetriagewindows-defaults
WMI Persistence Investigation Checklist
Step-by-step checklist for WMI persistence: live queries, the repository, event IDs 5860 and 5861, Sysmon 19-21, execution evidence and a safe clean-up.
wmiincident-responseevent-logspersistence
SCCM RecentlyUsedApps: evidence of execution in WMI
Read CCM_RecentlyUsedApps from the WMI repository: which programs each user ran, when last and how often, including older copies carved from OBJECTS.DATA.
wmisccmevidence-of-executionobjects-data