Windows Security: Remote WMI ActiveScriptEventConsumers via scrcons.exe (Event ID 4624 LogonType 3)

title: "Windows Security: Remote WMI ActiveScriptEventConsumers via scrcons.exe (Event ID 4624 LogonType 3)"
id: 54876247-6c06-416c-aafa-ccec0c3d8548
status: test
description: This rule identifies successful network logons (Event ID 4624, LogonType 3) where the process name ends with scrcons.exe, which can indicate remote WMI ActiveScriptEventConsumers activity. Such behavior matters because it can support lateral movement and persistence by executing attacker-controlled logic through WMI. Detection relies on Windows Security audit telemetry for interactive/network logon events and the associated process name, excluding cases matching a specific Local System TargetLogonId pattern.
references:
  - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/security/account_management/win_security_scrcons_remote_wmi_scripteventconsumer.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-09-02
modified: 2024-09-02
tags:
  - attack.lateral-movement
  - attack.privilege-escalation
  - detection.threat-hunting
  - attack.persistence
  - attack.t1546.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    ProcessName|endswith: scrcons.exe
  filter_main_local_system:
    TargetLogonId: "0x3e7"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - SCCM
level: medium
license: DRL-1.1
related:
  - id: 9599c180-e3a8-4743-8f92-7fb96d3be648
    type: derived