WMI and WinRM

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

3

wmi.event

string

What the WMI-Activity record is: provider loaded (5857), client operation failed (5858) or temporary subscription (5860). WMI does not log an operation that succeeded: a client's queries and method calls are seen only when they fail.

wmi.provider

string

The WMI provider WMI loaded (5857): its registered name.

wmi.provider_path

string

The provider's DLL as WMI recorded it (5857) - with its %variables% as written.

wmi.provider_location

string

Where the provider's DLL is: "Windows folder", "Program Files", "Microsoft's ProgramData folder" (Defender's platform, Visual Studio's setup) or "elsewhere" - a folder providers are not installed to, such as a profile, Temp or ProgramData.
derived: classified by Signal from wmi.provider_path, with this host's folders

wmi.host_process

string

The process the provider was loaded into (5857), usually WmiPrvSE.exe, with its PID.

wmi.operation

string

The client's operation that failed (5858): the call, its namespace and its query or method, e.g. "Start IWbemServices::ExecQuery - root\cimv2 : SELECT ...".

wmi.result_code

string

WMI's result code for the failed operation (5858), e.g. 0x80041003 access denied, 0x8004100C not supported.

wmi.namespace

string

The WMI namespace of a temporary subscription (5860).

wmi.query

string

The event filter's query: what event triggers the subscription (a time, a logon, a process start...).

wmi.client_machine

string

The computer the WMI client ran on (5858, 5860), as WMI recorded it - this host's name for a local client.

wmi.client_remote

bool

Whether the client ran on another computer than this one (its name is not the host's, localhost or a loopback address).
derived: compared by Signal with the record's computer name

wmi.user

string

The account the WMI client ran as (5858, 5860), as WMI recorded it.

wmi.client_pid

string

The client process's ID (5858, 5860) - of a process on the client's computer.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

Kind

State - something true when Signal read the host

Built-in rules reading it

1

wmi.filter

string

A WMI subscription's event filter: its name.

wmi.query

string

The event filter's query: what event triggers the subscription (a time, a logon, a process start...).

wmi.consumer

string

The subscription's consumer: its class and name, e.g. CommandLineEventConsumer.Name="x". CommandLine and ActiveScript consumers run code; the others log or mail.

persist.command

string

What the entry runs, exactly as configured (environment variables unexpanded); a task's actions joined by "; ".

persist.sources

string

Every source the entry was read from, e.g. "TaskCache registry, task XML file, Task Scheduler (WMI)".
derived: set by Signal when it merges the sources of one entry

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

1

wmi.filter

string

A WMI subscription's event filter: its name.

wmi.query

string

The event filter's query: what event triggers the subscription (a time, a logon, a process start...).

wmi.consumer

string

The subscription's consumer: its class and name, e.g. CommandLineEventConsumer.Name="x". CommandLine and ActiveScript consumers run code; the others log or mail.

persist.command

string

What the entry runs, exactly as configured (environment variables unexpanded); a task's actions joined by "; ".

log.event_time

time

When a log record was written (its TimeCreated).

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

2

winrm.direction

string

outbound - this host opened a WinRM session to another (WinRM 6, the client side); inbound - a shell was created on this host for a client (WinRM 91, the server side).

winrm.peer

string

The computer an outbound session went to, from its connection string. An inbound record does not name the client: its address is in the Security log's network logon (4624 type 3) of the same moment.

winrm.target

string

What the session was for: an outbound session's connection string (address, port, PowerShell version); an inbound shell's resource URI (the endpoint, e.g. Microsoft.PowerShell).

winrm.loopback

bool

Whether an outbound session went to this host itself (its own name, localhost or a loopback address) - local management, not a move to another host.
derived: compared by Signal with the record's computer name

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)