WMI Classes

Querying Windows endpoints with WMI using Orbital

On top of existing osquery tables, Orbital allows you to query your endpoints using a familiar SQL syntax against a set of exposed Microsoft WMI Classes. Like existing osquery tables, classes can be queried for data using the SELECT statement, e.g.:

SELECT InstallState FROM Win32_OptionalFeature WHERE Name = 'TelnetClient';

Queries against WMI Classes can be combined with queries against other non-WMI Orbital tables (e.g. using JOIN) which allows for complex querying capabilities between multiple data sources.

The following exposed classes are outlined below with their corresponding WMI Namespace.

Namespaces

Note: Not all WMI namespaces are supported by all versions of Windows. Please refer to the Reference links provided in the class descriptions for more information on the minimum supported Windows version for each namespace.

Namespace: ROOT\CIMV2

Classes

Class: “Win32_Printer”

Class: “Win32_WinSat”

Class: “Win32_OSRecoveryConfiguration”

Class: “Win32_ShortcutFile”

Class: “Win32_Registry”

Class: “Win32_OptionalFeature”

Class: “Win32_NtLogEvent”

Note: Win32_NtLogEvent will attempt to query all Windows events that exist on the endpoint. For performant queries on endpoints with many Windows events it is strongly recommended to add a WHERE clause to limit the number of results, e.g. WHERE TimeGenerated >= 1597943950.

Class: “Win32_NtEventLogFile”

Class: “Win32_UserAccount”

Class: “Win32_SystemDriver”

Class: “Win32_Processor”

Class: “SoftwareLicensingService”

Class: “Win32_ShadowCopy”

Class: “Win32_Volume”

Class: “SoftwareLicensingProduct”

Namespace: Root\CIMV2\Security\MicrosoftTpm

Classes

Class: “Win32_Tpm”

Namespace: Root\SecurityCenter2

Classes

Class: “AntiVirusProduct”

Class: “FirewallProduct”

Namespace: Root\Microsoft\Windows\DeviceGuard

Classes

Class: “Win32_DeviceGuard”

Namespace: Root\Microsoft\SecurityClient

Classes

Class: “Malware”

Namespace: root\microsoft\windows\defender

Classes

Class: “MSFT_MpComputerStatus”

Namespace: root\cimv2\power

Classes

Class: “Win32_PowerPlan”

Return to Table of Contents