DFIRHub

Windows event log ยท Microsoft-Windows-WMI-Activity/Operational5860 WMI Registration of Temporary Event Consumer

WMI Registration of Temporary Event Consumer

  • Windows operational
  • 4 fields
  • Microsoft-Windows-WMI-Activity%4Operational.evtx
  • Microsoft-Windows-WMI-Activity

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • PayloadData1Query: %Query%
    • %Query% = /Event/UserData/Operation_TemporaryEssStarted/Query
  • PayloadData2PID: %Processid%
    • %Processid% = /Event/UserData/Operation_TemporaryEssStarted/Processid
  • PayloadData3Client machine: %ClientMachine%
    • %ClientMachine% = /Event/UserData/Operation_TemporaryEssStarted/ClientMachine
  • PayloadData4User: %User%
    • %User% = /Event/UserData/Operation_TemporaryEssStarted/User

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-WMI-Activity" Guid="1418ef04-b0b4-4623-bf7e-d74ab47bbdaa"/>
    <EventID>5860</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2018-08-06 19:22:10.9433075"/>
    <EventRecordID>5156</EventRecordID>
    <Correlation ActivityID="7e5ddd23-2dba-0000-96ec-5d7eba2dd401"/>
    <Execution ProcessID="1484" ThreadID="5592"/>
    <Channel>Microsoft-Windows-WMI-Activity/Operational</Channel>
    <Computer>base-rd-01.shieldbase.lan</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <UserData>
    <Operation_TemporaryEssStarted>
      <NamespaceName>ROOT\CIMV2</NamespaceName>
      <Query>SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'</Query>
      <User></User>
      <Processid>1484</Processid>
      <ClientMachine>BASE-RD-01</ClientMachine>
      <PossibleCause>Temporary</PossibleCause>
    </Operation_TemporaryEssStarted>
  </UserData>
</Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-WMI-Activity-Operational_Microsoft-Windows-WMI-Activity_5860.map(opens in new tab) by Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)