{"id":3093,"date":"2015-06-19T17:08:33","date_gmt":"2015-06-19T17:08:33","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3093"},"modified":"2015-06-19T17:10:03","modified_gmt":"2015-06-19T17:10:03","slug":"basic-intro-to-wmi-and-wql-queries","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/06\/19\/basic-intro-to-wmi-and-wql-queries\/","title":{"rendered":"Basic intro to WMI and WQL queries"},"content":{"rendered":"

WMI<\/a> is an important component of Windows OS and everyone knows about it so I won’t get into detail about what it is (read the linked wikipedia article if you want to know). I will focus on practical stuff instead which we come across more and more often.<\/p>\n

I will begin by saying that nowadays lots of malware is using WMI – either to establish a stealthy persistence mechanism, or query various information from the system. This typically is done using WQL queries which are so popular that even a couple of typical OS commands are implemented as ‘processors’ simply interpreting results of many WQL queries instead of actually using old-school APIs.<\/p>\n

A good example is a tasklist.exe. If you ever launched it from a command line and observed a slight delay before it returned the data it is because it has to ‘talk’ to WMI first and sometimes WMI initialization may take a while.<\/p>\n

This particular program is actually a good example we can use to show what exactly happens when it ‘talks’ to WMI.<\/p>\n

Have a look at the Tasklist.exe log below.<\/p>\n