Techniques
Sample rules
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
- source: sigma
- technicques:
- t1546
- t1546.003
Description
Detects signs of the WMI script host process “scrcons.exe” loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Detection logic
condition: selection
selection:
ImageLoaded|endswith:
- \vbscript.dll
- \wbemdisp.dll
- \wshom.ocx
- \scrrun.dll
Image|endswith: \scrcons.exe
WMI Persistence - Script Event Consumer
- source: sigma
- technicques:
- t1546
- t1546.003
Description
Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance and will execute registered JScript or VBScript code as a result. Script event consumers are a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse script event consumers to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.
Detection logic
condition: selection
selection:
Image: C:\WINDOWS\system32\wbem\scrcons.exe
ParentImage: C:\Windows\System32\svchost.exe