The blog post by the team that did the port (Trail of Bits), mentions that it uses wmi and shims the data into osquery.

https://blog.trailofbits.com/2016/09/27/windows-network-secu...