Add `WMI` activity telemetry

[rabbitstack]

Motivation

WMI is a common vector for lateral movement, remote execution, and persistence (e.g. Win32_Process::Create, permanent WMI event subscriptions via __EventFilter/__EventConsumer/__FilterToConsumerBinding). Fibratus has no visibility into WMI activity today. The Microsoft-Windows-WMI-Activity provider exposes both live operation calls (OperationStart) and the operational-log events that track event filter registration, consumer execution, and filter-to-consumer bindings. This is the exact mechanism abused for WMI-based persistence.

Expectation

Fibratus gains new event types sourced from the Microsoft-Windows-WMI-Activity provider.

Event ID	Channel	Fibratus event type	Purpose
11	/Trace	Wmi	Every IWbemServices call (OperationStart)
5859	/Operational	SubscribeWmiFilter	A registered event filter's notification query is activated against a provider
5861	/Operational	BindWmiFilter	An __EventFilter is bound to a __EventConsumer. This is the classic permanent-subscription persistence mechanism

Proposal

• Attach to both the Microsoft-Windows-WMI-Activity/Trace and Microsoft-Windows-WMI-Activity/Operational channels

• Event 11 (OperationStart, version 0) maps to Wmi event type as previously specified: CorrelationId (string), GroupOperationId (uint32), OperationId (uint32), Operation (string represents the IWbemServices::() call, e.g. ExecQuery/GetObject/PutInstance/DeleteInstance/ExecMethod/CreateClass), ClientMachine (string), ClientMachineFQDN (string), User (string), ClientProcessId (uint32), ClientProcessCreationTime (uint64), NamespaceName (string), IsLocal (bool)

• Event 5859 (version 0) maps to SubscribeWmiFilter event type:

Field	Type	Notes
NamespaceName	string	WMI namespace the filter is registered in
Query	string	The notification query (NotificationQuery). The WQL filter text, e.g. SELECT * FROM __InstanceCreationEvent...
User	string	Owner of the filter (OwnerName)
processid	uint32	Hosting process ID (HostProcessID)
providerName	string	WMI provider servicing the query
queryid	uint32	Query identifier
PossibleCause	string	Diagnostic hint supplied by WMI

• Event 5861 (version 0) maps to BindWmiFilter event type.

Field	Type	Notes
Namespace	string	Namespace containing the binding
ESS	string	The __EventFilter name (event message calls this Eventfilter; correlates to the filter activated in event 5859)
CONSUMER	string	The __EventConsumer name the filter is bound to
PossibleCause	string	Diagnostic hint supplied by WMI

• Decode all four event types via the ParamDecoder, consistent with the rest of the WMI telemetry work