Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)

Alerts on rare child processes spawned by scrcons.exe, which may indicate abuse of Script Event Consumer for execution.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Sittikorn S (SigmaHQ), DRL 1.1
Published: 2021-06-21
Updated: 2026-07-30

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where the parent process is Script Event Consumer (scrcons.exe) and the child executable matches a set of common script execution and living-off-the-land binaries. Attackers may abuse scrcons.exe to launch additional processes for execution, scripting, or indirect payload delivery. Telemetry required is Windows process creation events containing parent and child image paths.

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange

Malicious Impacket wmiexec Command Execution via WmiPrvSE Spawning cmd with Admin-Share Output Redirect (via process_creation)

Malicious QDoor Remote Proxy Execution via WMIC Node Process Call Create of svhost from Temp (via process_creation)

Malicious Remote Payload Deployment via WMIC Node Process Call Create with bitsadmin Transfer (via process_creation)

Malicious WMIexec Style Command Output Redirection to Local Admin Share

Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect

Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)

Suspicious System Reconnaissance Output Redirected to PDF File (via process_creation)

Suspicious Phantom Taurus mssq.bat SQL Execution via WMI (via process_creation)

Malicious Antivirus Removal via WMIC Product Uninstall

Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)

Pivot detection · T1047 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-child-process-spawned-by-scrcons-exe-script-event-consumer-f6d1dd2f

title: "Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)"
id: 5376d9b1-67d4-437c-a61a-38d4578d905d
status: test
description: This rule flags process creation where the parent process is Script Event Consumer (scrcons.exe) and the child executable matches a set of common script execution and living-off-the-land binaries. Attackers may abuse scrcons.exe to launch additional processes for execution, scripting, or indirect payload delivery. Telemetry required is Windows process creation events containing parent and child image paths.
references:
  - https://redcanary.com/blog/child-processes/
  - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_scrcons_susp_child_process.yml
author: Sittikorn S, Huntrule Team
date: 2021-06-21
modified: 2022-07-14
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \scrcons.exe
    Image|endswith:
      - \svchost.exe
      - \dllhost.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
      - \cscript.exe
      - \schtasks.exe
      - \regsvr32.exe
      - \mshta.exe
      - \rundll32.exe
      - \msiexec.exe
      - \msbuild.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f6d1dd2f-b8ce-40ca-bc23-062efb686b34
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL