{
	"id": "4cbc846a-a4aa-4802-a940-69b37564956d",
	"created_at": "2026-04-06T00:14:11.580281Z",
	"updated_at": "2026-04-10T13:12:40.779232Z",
	"deleted_at": null,
	"sha1_hash": "32c72c9121ce113e0ceccd3f941399de177b2b09",
	"title": "WMI System Classes - Win32 apps",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 67604,
	"plain_text": "WMI System Classes - Win32 apps\r\nBy stevewhims\r\nArchived: 2026-04-05 22:58:44 UTC\r\n__AbsoluteTimerInstruction Causes an event to be generated on a specific date at a specific time. __ACE\r\nRepresents an access control entry (ACE). __AggregateEvent Represents an aggregate event of several individual\r\nintrinsic or extrinsic events. __ArbitratorConfiguration Configuration class that limits the internal resources that\r\nare used by operations initiated by WMI clients. __CacheControl Determines when WMI should release a\r\nComponent Object Model (COM) object. __CIMOMIdentification Describes the local installation of WMI.\r\n__ClassCreationEvent Represents a class creation event, which is a type of intrinsic event generated when a new\r\nclass is added to the namespace. __ClassDeletionEvent Represents a class deletion event, which is a type of\r\nintrinsic event generated when a class is removed from the namespace. __ClassModificationEvent Represents a\r\nclass modification event, which is a type of intrinsic event generated when a class is changed in the namespace.\r\n__ClassOperationEvent A base class for all intrinsic events that relate to a class. __ClassProviderRegistration\r\nRegisters class providers in WMI. __ConsumerFailureEvent Represents the occurrence of some other event that\r\nis being dropped because of the failure of an event consumer. __Event An abstract base class that serves as the\r\nparent class for all intrinsic and extrinsic events. __EventConsumer An abstract base class that is used in the\r\nregistration of a permanent event consumer. __EventConsumerProviderCacheControl Determines when WMI\r\nshould release an event consumer provider. __EventConsumerProviderRegistration Registers event consumer\r\nproviders with WMI. __EventDroppedEvent Represents the occurrence of an event that is dropped. A dropped\r\nevent is an event that is not delivered to an event consumer. __EventFilter Registration of a permanent event\r\nconsumer requires an instance of the __EventFilter system class. __EventGenerator Serves as a parent class for\r\nclasses that control the generation of events, such as timer events. __EventProviderCacheControl Controls when\r\nan event provider is unloaded. __EventProviderRegistration Registers event providers with WMI.\r\n__EventQueueOverflowEvent Reports when an event is dropped as a result of delivery queue overflow.\r\n__EventSinkCacheControl Used to determine when WMI releases an event consumer provider's\r\nIWbemUnboundObjectSink pointer. __ExtendedStatus Used to report detailed status and error information.\r\n__ExtrinsicEvent Serves as a parent class for all user-defined event types, also known as extrinsic events.\r\n__FilterToConsumerBinding Used in the registration of permanent event consumers to relate an instance of the\r\nof __EventConsumer to an instance of __EventFilter. __IndicationRelated Serves as a parent class for all\r\nevent-related classes. __InstanceCreationEvent Reports an instance creation event, which is a type of intrinsic\r\nevent that is generated when a new instance is added to the namespace. __InstanceDeletionEvent Reports an\r\ninstance deletion event, which is a type of intrinsic event generated when an instance is deleted from the\r\nnamespace. __InstanceModificationEvent Reports an instance modification event, which is a type of intrinsic\r\nevent generated when an instance changes in the namespace. __InstanceOperationEvent Serves as a base class\r\nfor all intrinsic events that relate to an instance. __InstanceProviderRegistration Registers instance providers in\r\nWMI. __IntervalTimerInstruction Generates events at intervals, similar to a WM_TIMER message in\r\nWindows programming. __MethodInvocationEvent This class is not implemented.\r\n__MethodProviderRegistration Registers method providers with WMI. __Namespace Represents a WMI\r\nhttps://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-system-classes\r\nPage 1 of 2\n\nnamespace. __NamespaceCreationEvent Reports a namespace creation event, which is a type of intrinsic event\r\ngenerated when a new namespace is added to the current namespace. __NamespaceDeletionEvent Reports a\r\nnamespace deletion event, which is a type of intrinsic event that is generated when a sub-namespace is removed\r\nfrom the current namespace. __NamespaceModificationEvent Reports a namespace modification event, which is\r\na type of intrinsic event that is generated when a namespace is modified. __NamespaceOperationEvent A base\r\nclass for all intrinsic events that relate to a namespace. __NotifyStatus Serves as the parent class for provider-defined error classes. __NTLMUser9X Controls remote access to a computer running unsupported versions of\r\nWindows. __ObjectProviderCacheControl Controls when a class or instance provider is unloaded.\r\n__ObjectProviderRegistration Serves as the parent for classes that are used to register class and instance\r\nproviders in WMI. __PARAMETERS Defines the input and output parameters for methods.\r\n__PropertyProviderCacheControl Controls the cache when a property provider is unloaded.\r\n__PropertyProviderRegistration Registers property providers in WMI. __Provider Serves as the parent class\r\nfor the __Win32Provider system class. __ProviderHostQuotaConfiguration Allows limits to be set on host\r\nprocess usage of system resources. __ProviderRegistration Serves as the parent class for registration classes for\r\nvarious types of providers. __SecurityDescriptor Represents a security descriptor. __SecurityRelatedClass\r\nServes as a parent class for all types of security classes. __SystemClass Base class from which most system\r\nclasses derive. __SystemEvent Represents a system event. __SystemSecurity Contains methods that let you\r\naccess and modify the security settings for a namespace. __thisNAMESPACE Holds the security rights for the\r\nnamespace in the form of a security descriptor. __TimerEvent Reports an event generated by WMI in response to\r\na consumer's request for an interval timer event or an absolute timer event. __TimerInstruction Specifies\r\ninstructions on how timer events should be generated for consumers. __TimerNextFiring Reserved for operating\r\nsystem use. __Trustee Represents a trustee. Either a name or a SID (byte array) can be used. __Win32Provider\r\nRegisters information about a provider's physical implementation in WMI.\r\nSource: https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-system-classes\r\nhttps://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-system-classes\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-system-classes"
	],
	"report_names": [
		"wmi-system-classes"
	],
	"threat_actors": [],
	"ts_created_at": 1775434451,
	"ts_updated_at": 1775826760,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/32c72c9121ce113e0ceccd3f941399de177b2b09.pdf",
		"text": "https://archive.orkl.eu/32c72c9121ce113e0ceccd3f941399de177b2b09.txt",
		"img": "https://archive.orkl.eu/32c72c9121ce113e0ceccd3f941399de177b2b09.jpg"
	}
}