Skip to content
Parses the WMI object database....looking for persistence
Branch: master
Clone or download
Latest commit 754ce11 Dec 7, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
source Updated docs Dec 7, 2018 Updated docs Dec 7, 2018
readme.pdf Updated docs Dec 7, 2018



There is nothing new here! It is just a rewrite of @DavidPany excellent work into WMI parsing. The original pythin code can be found here:


I need WMI parsing for autorunner, so converted the original python code to C#, and thought it might as well be available as a standalone tool. The only added feature is CSV export


.\wmi-parser.exe -i .\OBJECTS.DATA

wmi-parser v0.0.1

Author: Mark Woan / woanware (

  SCM Event Log Consumer-SCM Event Log Filter - (Common binding based on consumer and filter names,  possibly legitimate)
    Consumer: NTEventLogEventConsumer ~ SCM Event Log Consumer ~ sid ~ Service Control Manager

      Filter Name : SCM Event Log Filter
      Filter Query: select * from MSFT_SCMEventLogEvent


    Name: BadStuff
    Type: CommandLineEventConsumer
    Arguments: powershell.exe -NoP Start-Process ('badstuff.exe')

      Filter Name : DeviceDocked
      Filter Query: SELECT * FROM Win32_SystemConfigurationChangeEvent 
You can’t perform that action at this time.