Initial construction of a WMI object, such as a filter, consumer, subscription, binding, or providers.
| Name | Channel |
|---|---|
| WinEventLog:Application | WMI Object Creation Events |
| WinEventLog:WMI | Creation or modification of __EventFilter, __FilterToConsumerBinding, or CommandLineEventConsumer |
| WinEventLog:WMI | EventCode=5857, 5858, 5860, 5861 |