> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/docs/windows-documentation/wmi-classes.md).

# WMI Classes

## Query Examples

### Query examples with Get-CimInstance

List **all** services with their state and pathnames using [Win32\_Service](https://powershell.one/wmi/root/cimv2/win32_service)

```powershell
Get-CimInstance -ClassName win32_service | Select Name,State,PathName 
```

List **running** services with their pathnames using [Win32\_Service](https://powershell.one/wmi/root/cimv2/win32_service)

```powershell
Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}
```

## WMI Classes Documentation

### General Documentation

Namespace root/cimv2 - powershell.one: <https://powershell.one/wmi/root/cimv2>

WMI Classes - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-classes>

### Win32\_LoggedOnUser

Win32\_LoggedOnUser - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-loggedonuser>

### Win32\_Process

Win32\_Process - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process>

Win32\_Process - powershell.one: <https://powershell.one/wmi/root/cimv2/win32_process>

### Win32\_Service

Win32\_Service - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service>

Win32\_Service - powershell.one: <https://powershell.one/wmi/root/cimv2/win32_service>

### Win32\_Share

Win32\_Share - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-share>

Win32\_Share - powershell.one: <https://powershell.one/wmi/root/cimv2/win32_share>

### Win32\_StartupCommand

Win32\_StartupCommand - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-startupcommand>

Win32\_StartupCommand - powershell.one: <https://powershell.one/wmi/root/cimv2/win32_startupcommand>

## Resources

Get-CimInstance - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-5.1>

Windows Management Instrumentation - Wikipedia: <https://en.wikipedia.org/wiki/Windows_Management_Instrumentation>

Working with WMI - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/scripting/learn/ps101/07-working-with-wmi?view=powershell-5.1>

WQL (SQL for WMI) - Microsoft Learn: <https://learn.microsoft.com/en-us/windows/win32/wmisdk/wql-sql-for-wmi>

WQL - Wikipedia: <https://en.wikipedia.org/wiki/WQL>