Windows WMI Persistence via scrcons.exe Script Event Consumer File Writes

Flags file writes performed by scrcons.exe, indicating potential WMI script event consumer persistence activity.

FreeUnreviewedSigmahighv1

windows-wmi-persistence-via-scrcons-exe-script-event-consumer-file-writes-33f41cdd

title: Windows WMI Persistence via scrcons.exe Script Event Consumer File Writes
id: d14a6bbe-7f57-4fe9-aad3-907846abe09c
status: test
description: This rule flags file write activity where the process Image is C:\WINDOWS\system32\wbem\scrcons.exe, which is associated with WMI script event consumer persistence behavior. Attackers may use WMI to maintain access by registering script consumers that execute on event triggers. The detection relies on Windows file event telemetry that records the writing process path and correlates it to scrcons.exe.
references:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_wmi_persistence_script_event_consumer_write.yml
author: Thomas Patzke, Huntrule Team
date: 2018-03-07
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.t1546.003
  - attack.persistence
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image: C:\WINDOWS\system32\wbem\scrcons.exe
  condition: selection
falsepositives:
  - Dell Power Manager (C:\Program Files\Dell\PowerManager\DpmPowerPlanSetup.exe)
level: high
license: DRL-1.1
related:
  - id: 33f41cdd-35ac-4ba8-814b-c6a4244a1ad4
    type: derived

What it detects

This rule flags file write activity where the process Image is C:\WINDOWS\system32\wbem\scrcons.exe, which is associated with WMI script event consumer persistence behavior. Attackers may use WMI to maintain access by registering script consumers that execute on event triggers. The detection relies on Windows file event telemetry that records the writing process path and correlates it to scrcons.exe.

Known false positives

Dell Power Manager (C:\Program Files\Dell\PowerManager\DpmPowerPlanSetup.exe)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.