Description

WMISubscriptionsView is a forensics and system management tool for Windows. It can list Windows Management Instrumentation (WMI) Event Subscriptions and let the user view, export and delete them. The user can also add new event subscriptions via this utility. WMI Event Subscriptions can be very useful for software and system administrators, as it can detect operations like USB drive connection, process start, system uptime etc. but it is also very dangerous as hackers and malware developers can use them to establish persistence on the system. This persistence technique is one of the hardest ones to detect in Windows operating system as it writes no files to the disk (Fileless malware). This tool can list those subscriptions, and highlight ones with potentially suspicious command lines (such as cmd, powershell, wscript). This tool can be very useful in investigations, as it also supports extracting information like query and command line from the event and saving them to the file. The user can also create their own subscriptions and delete existing ones. You can use the search bar for filtering subscriptions. This application requires .NET Framework 4.7.2 and Windows 7 or a later operating system.

Features

• List WMI Event Subscriptions.
• Highlight malicious subscriptions.
• Search filter for filtering subscriptions.
• Ability to create, delete and export subscriptions.
• Multi language support.
• Can be used for detecting malicious WMI Events.

File Verification & Safety

To make sure that the tool is downloaded properly, you can check the file SHA-256 hash.

Disclaimer: This free software is provided "as-is" without warranty of any kind, express or implied. The developer assumes no liability for data misplacement or system damage resulting from improper deployment or system anomalies this tool can cause.

Change Log

Version 1.2.0 - 16/10/2026:

[+] New Features:
• Added the ability to get more information from subscriptions. You can double click to any item to show details.
• Added search/filter feature.
• Added status bar.
• Added sorting feature.
• Added shield icons to operations that require administrative privileges.
• Upgraded .NET Framework version to 4.7.2. The application now requires Windows 7 or a later operating system.

[*] Fixes and Improvements:
• Fixed several bugs on language system.
• Various bug fixes and improvements.

Version v1.1.1 08/08/2026:

[*] Fixes:
• Fixed false positive problems.

Version v1.1.0 04/07/2026:

[+] New Features:
• Added Multi language support. You can help me with translation at https://deuteriumsoftware.com/translate
• Changed highlight color to yellow.
• Improved keyboard shortcuts and tab indexes at About and Create Subscriptions form.
• Added Translate to Help.

[*] Fixes:
• Fixed that highlight text was not visible.
• Fixed a problem that caused the tool not to show Script File or Script Text on script based subscriptions.
• Other fixes.

Version v1.0.0 02/07/2026:
• Initial release.