DFIRHub

Windows event log ยท Microsoft-Windows-WMI-Activity/Operational5857 WMI wmiprvse execution

Indicates time of wmiprvse execution and path to provider DLL - attackers sometimes install malicious WMI provider DLLs

  • Windows operational
  • 2 fields
  • Microsoft-Windows-WMI-Activity%4Operational.evtx
  • Microsoft-Windows-WMI-Activity

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1PID: %ProcessID%
    • %ProcessID% = /Event/UserData/Operation_StartedOperational/ProcessID
  • PayloadData2Path: %ProviderPath%
    • %ProviderPath% = /Event/UserData/Operation_StartedOperational/ProviderPath

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-WMI-Activity" Guid="1418ef04-b0b4-4623-bf7e-d74ab47bbdaa"/>
    <EventID>5857</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2018-08-04 15:57:45.6043407"/>
    <EventRecordID>4957</EventRecordID>
    <Correlation/>
    <Execution ProcessID="3184" ThreadID="10584"/>
    <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
    <Computer>base-rd-01.shieldbase.lan</Computer>
    <Security UserID="S-1-5-20"/>
  </System>
  <UserData>
    <Operation_StartedOperational>
      <ProviderName>CIMWin32a</ProviderName>
      <Code>0x0</Code>
      <HostProcess>wmiprvse.exe</HostProcess>
      <ProcessID>3184</ProcessID>
      <ProviderPath>%systemroot%\system32\wbem\wmipcima.dll</ProviderPath>
    </Operation_StartedOperational>
  </UserData>
</Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-WMI-Activity-Operational_Microsoft-Windows-WMI-Activity_5857.map(opens in new tab) by Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)