# Command Line Event Consumers

## Overview

**Evidence:** WMI Command Line\
**Description:** Dump WMI Command Line Event Consumers\
**Category:** System\
**Platform:** windows\
**Short Name:** wmicec\
**Is Parsed:** Yes\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** No

## Background

WMI CommandLineEventConsumers execute command-line programs when specific WMI events occur. This persistence mechanism allows attackers to launch executables or scripts with SYSTEM privileges in response to system events.

CommandLine consumers can execute any command-line program, including PowerShell, cmd.exe, or malicious executables.

## Data Collected

This collector gathers structured data about wmi command line.

### WMI Command Line Data

| Field               | Description                 | Example                            |
| ------------------- | --------------------------- | ---------------------------------- |
| `Name`              | Consumer name               | BadConsumer                        |
| `PayloadCommand`    | Command template to execute | cmd.exe /c powershell.exe -enc ... |
| `PayloadExecutable` | Executable path             | C:\Windows\System32\cmd.exe        |

## Collection Method

This collector queries WMI for CommandLineEventConsumer instances in multiple namespaces:

* `ROOT\Subscription`
* `ROOT\DEFAULT`
* `ROOT\CIMV2`

## Forensic Value

CommandLine consumers enable command execution persistence. Investigators use this data to detect WMI command-based persistence, identify malicious command payloads, track PowerShell execution via WMI, and detect living-off-the-land persistence.
