Windows WMI Persistence: Script Event Consumer File Writes (scrcons.exe)

Flags file writes performed by scrcons.exe, indicating potential WMI script event consumer persistence activity.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2018-03-07
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546.003Windows Management Instrumentation Event Subscription
Priv Esc
- T1546.003Windows Management Instrumentation Event Subscription
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file write events involving the WMI script event consumer executable located at C:\WINDOWS\system32\wbem\scrcons.exe. Attackers can use WMI event consumers to achieve persistence by executing scripts in response to system or management events. Detection relies on Windows file event telemetry that records writes to this specific WMI component, as well as the executable path in the event data.

Reporting behind it

Related detections9 linkedT1546.003 — drag to rearrange

Malicious WMI Registration - PowerShell (via powershell)

Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)

Windows WMI Event Consumer with Encoded Payload Containing Suspicious Strings

PowerShell WMI Event Subscription Persistence via New-CimInstance

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Windows Security 4624 Logon for scrcons.exe Indicating Remote WMI ActiveScriptEventConsumers

WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Windows WMI Persistence: Script Event Consumer File Writes (scrcons.exe)

Pivot detection · T1546.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-wmi-persistence-via-scrcons-exe-script-event-consumer-file-writes-33f41cdd

title: "Windows WMI Persistence: Script Event Consumer File Writes (scrcons.exe)"
id: d14a6bbe-7f57-4fe9-aad3-907846abe09c
status: test
description: This rule flags file write events involving the WMI script event consumer executable located at C:\WINDOWS\system32\wbem\scrcons.exe. Attackers can use WMI event consumers to achieve persistence by executing scripts in response to system or management events. Detection relies on Windows file event telemetry that records writes to this specific WMI component, as well as the executable path in the event data.
references:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_wmi_persistence_script_event_consumer_write.yml
author: Thomas Patzke, Huntrule Team
date: 2018-03-07
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.t1546.003
  - attack.persistence
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image: C:\WINDOWS\system32\wbem\scrcons.exe
  condition: selection
falsepositives:
  - Dell Power Manager (C:\Program Files\Dell\PowerManager\DpmPowerPlanSetup.exe)
level: high
license: DRL-1.1
related:
  - id: 33f41cdd-35ac-4ba8-814b-c6a4244a1ad4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL