WMI repository and SCCM RecentlyUsedApps

What it is

Windows Management Instrumentation (WMI) stores its classes and instances in the CIM repository, a set of database files under wbem\Repository. Two things in that database matter to investigators:

• Permanent event subscriptions, a well-known fileless persistence technique. An __EventFilter (a WQL query describing a trigger), an event consumer (what to run) and a __FilterToConsumerBinding (linking the two) are stored as objects. Once bound, the WMI service runs the consumer as SYSTEM every time the filter fires, with nothing in Run keys, services or scheduled tasks.
• SCCM software metering data. On Configuration Manager clients, the CCM_RecentlyUsedApps class in the root\ccm\SoftwareMeteringAgent namespace records executables that were launched, with user, launch count and last-used time. It is a strong evidence of execution source that survives deletion of the binary.

Location

What it proves

• Persistence: a filter, a consumer and a binding with the command or script that runs, even when no file is dropped.
• Execution on SCCM clients: executable name, folder path, the last user, launch count and last-used time, plus version information of the file.
• Registration events: 5861 records a new permanent binding with its filter query and consumer details, when the log is available.
• It does not give a documented creation time for subscription objects, nor who created them. Pair it with event logs, Sysmon (events 19, 20, 21) and process creation data.

Key fields

Timestamps

Retention and clearing

• Subscriptions persist until the objects are deleted (for example with Remove-WmiObject or Remove-CimInstance). Deleted objects may remain in unused pages of OBJECTS.DATA until overwritten; string searches of the raw file can surface them.
• CCM_RecentlyUsedApps keeps records while the SCCM client is installed; older repository copies in volume shadow copies can add history.
• The WMI-Activity Operational log is small and rolls over quickly on busy systems.
• When WMI rebuilds a corrupted repository, it recompiles every MOF listed in Autorecover MOFs, so a subscription installed from an autorecover MOF comes back after the rebuild.

Collection

• KAPE target: WBEM (the whole Repository folder), MOF (every *.MOF on the volume, which is slow) and EventLogs for the WMI-Activity channel.
• Velociraptor (Windows.Triage.Targets): WBEM, MOF, EventLogs. Live analysis: Windows.Persistence.PermanentWMIEvents (bindings with their filters and consumers across namespaces); Windows.System.WMIQuery can query CCM_RecentlyUsedApps on a live client.
• Built-in: the repository files are held open by the WMI service; collect them from a shadow copy or with a raw-copy tool, and query live objects with PowerShell.

Get-CimInstance -Namespace root\subscription -ClassName __EventFilter
Get-CimInstance -Namespace root\subscription -ClassName __EventConsumer
Get-CimInstance -Namespace root\subscription -ClassName __FilterToConsumerBinding
Get-CimInstance -Namespace root\ccm\SoftwareMeteringAgent -ClassName CCM_RecentlyUsedApps
wevtutil epl Microsoft-Windows-WMI-Activity/Operational E:\case\WMI-Activity.evtx

Parsing tools

• python-cim / flare-wmi (Mandiant, open source): parses an offline repository (OBJECTS.DATA, INDEX.BTR, MAPPING*.MAP); sample scripts list persistence and CCM_RecentlyUsedApps records.
• WMI_Forensics (David Pany, open source): PyWMIPersistenceFinder.py finds bindings by searching OBJECTS.DATA; CCM_RUA_Finder.py extracts CCM_RecentlyUsedApps records to TSV.
• Velociraptor: Windows.Persistence.PermanentWMIEvents.
• Autoruns (Sysinternals, free): WMI tab on a live system.
• EvtxECmd (Eric Zimmerman): WMI-Activity events to CSV.
• RegRipper: wbem plugin reads the CIMOM key, including Autorecover MOFs.

Investigation tips

• Every binding in root\subscription deserves review; legitimate ones are few (some vendor agents) and easy to baseline across a fleet.
• Look for CommandLineEventConsumer running powershell.exe, cmd.exe or LOLBins, and for any ActiveScriptEventConsumer.
• Uptime or interval filters (Win32_PerfFormattedData_PerfOS_System, __IntervalTimerInstruction) and logon or process-start filters are common triggers.
• Process trees WmiPrvSE.exe -> powershell.exe or scrcons.exe activity point to a consumer firing; confirm with Prefetch of SCRCONS.EXE.
• mofcomp.exe in Prefetch or a MOF outside wbem suggests subscriptions were installed from a MOF file.
• On SCCM clients, parse CCM_RecentlyUsedApps even for non-WMI cases: it often lists attacker tools that are gone from disk, Amcache and Prefetch.
• Remote WMI (wmic /node, Invoke-WmiMethod) is a lateral movement channel: correlate with network logons in the event logs.