WMI: PowerShell Analysis

Analyzing the WMI (Windows Management Instrumentation) Repository is a critical task for both system administrators and security professionals. The WMI Repository, located in %SystemRoot%\System32\wbem\Repository, stores definitions for WMI Classes, Instances, and Event Consumers. Malicious actors may exploit WMI for persistence, lateral movement, or to execute malicious payloads, often leaving traces in the WMI Repository. This tutorial outlines steps to analyze the WMI Repository for signs of malicious activity.

Prerequisites

• Administrative access on the Windows system.

• Basic familiarity with WMI concepts and PowerShell.

• PowerShell scripting enabled on the system.

Step 1: Access the WMI Namespace

Start by accessing the WMI namespace where most system and security information is stored. The root\cimv2 namespace is commonly used for system management tasks, but for investigating malicious activity, the root\subscription namespace is more relevant because it contains information about WMI Event Subscriptions.

# Open PowerShell with administrative privileges
# Navigate to the root\subscription namespace
Get-WmiObject -Namespace "root\subscription" -List

Step 2: List WMI Event Consumers

Event Consumers are the actions taken in response to an event. Malicious scripts or commands can be hidden within these consumers.

Get-WmiObject -Namespace "root\subscription" -Class __EventConsumer

Pay attention to any consumers that execute scripts or commands, particularly those with unfamiliar or suspicious paths and commands.

Step 3: Investigate Event Filters

Event Filters define the criteria for the events that trigger the consumers. Understanding what triggers a suspicious consumer can provide context to the malicious activity.

Get-WmiObject -Namespace "root\subscription" -Class __EventFilter

Look for filters with unusual queries that might relate to system startup, user logon events, or other common persistence mechanisms.

Step 4: Examine Filter to Consumer Bindings

Bindings connect filters to consumers. Analyzing these can help you understand which filters trigger which consumers.

Get-WmiObject -Namespace "root\subscription" -Class __FilterToConsumerBinding

Identify any bindings that link suspicious filters to consumers, as these are potential indicators of compromise.

Step 5: Inspect Specific Consumers for Malicious Activity

Dive deeper into any suspicious consumers you've identified, examining their properties and the scripts or commands they execute.

# Replace "SuspiciousConsumer" with the actual name of the consumer you're investigating
Get-WmiObject -Namespace "root\subscription" -Class CommandLineEventConsumer -Filter "Name='SuspiciousConsumer'"

Step 6: Analyze Scripts and Executables

If the consumer involves executing a script or binary, manually review the content of these files or execute them in a controlled environment to understand their behavior.

Step 7: Review the WMI Activity Log

Windows logs WMI activity in the Microsoft-Windows-WMI-Activity/Operational log. Review this log for any recent activity related to the suspicious consumers, filters, or bindings you've identified.

Get-WinEvent -LogName "Microsoft-Windows-WMI-Activity/Operational"