Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Alerts on WMIC.exe command lines attempting to create an ActiveScriptEventConsumer for event-driven script execution.

FreeUnreviewedSigmahighv1

windows-process-creation-wmic-exe-activescripteventconsumer-creation-attempt-ebef4391

title: "Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt"
id: c89a9efc-aee5-4c60-aa96-aa7062781e26
status: test
description: This rule flags process creation events where WMIC.exe is executed with command-line text indicating creation of an ActiveScriptEventConsumer. ActiveScriptEventConsumer can trigger predefined VBScript or JScript execution in response to system events, making it a valuable persistence mechanism for attackers. The detection relies on Windows process creation telemetry, matching WMIC.exe image/path ending and specific command-line substrings containing "ActiveScriptEventConsumer" and " CREATE ".
references:
  - https://twitter.com/johnlatwc/status/1408062131321270282?s=12
  - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-06-25
modified: 2026-06-19
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: wmic.exe
    - Image|endswith: \WMIC.exe
  selection_cli:
    CommandLine|contains|all:
      - ActiveScriptEventConsumer
      - " CREATE "
  condition: all of selection_*
falsepositives:
  - Legitimate software creating script event consumers
level: high
license: DRL-1.1
related:
  - id: ebef4391-1a81-4761-a40a-1db446c0e625
    type: derived

What it detects

This rule flags process creation events where WMIC.exe is executed with command-line text indicating creation of an ActiveScriptEventConsumer. ActiveScriptEventConsumer can trigger predefined VBScript or JScript execution in response to system events, making it a valuable persistence mechanism for attackers. The detection relies on Windows process creation telemetry, matching WMIC.exe image/path ending and specific command-line substrings containing "ActiveScriptEventConsumer" and " CREATE ".

Known false positives

Legitimate software creating script event consumers

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.