Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)

title: "Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)"
id: 5376d9b1-67d4-437c-a61a-38d4578d905d
status: test
description: This rule flags process creation where the parent process is Script Event Consumer (scrcons.exe) and the child executable matches a set of common script execution and living-off-the-land binaries. Attackers may abuse scrcons.exe to launch additional processes for execution, scripting, or indirect payload delivery. Telemetry required is Windows process creation events containing parent and child image paths.
references:
  - https://redcanary.com/blog/child-processes/
  - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_scrcons_susp_child_process.yml
author: Sittikorn S, Huntrule Team
date: 2021-06-21
modified: 2022-07-14
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \scrcons.exe
    Image|endswith:
      - \svchost.exe
      - \dllhost.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
      - \cscript.exe
      - \schtasks.exe
      - \regsvr32.exe
      - \mshta.exe
      - \rundll32.exe
      - \msiexec.exe
      - \msbuild.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f6d1dd2f-b8ce-40ca-bc23-062efb686b34
    type: derived