Windows WMI Script Event Consumer Execution via scrcons.exe

Flags scrcons.exe starting under svchost.exe, indicating WMI script event consumer execution that can support persistence.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2018-03-07
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546.003Windows Management Instrumentation Event Subscription
Priv Esc
- T1546.003Windows Management Instrumentation Event Subscription
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process creation of scrcons.exe when it is launched with svchost.exe as the parent, indicating execution of a WMI script event consumer. Attackers can use script event consumers to run JScript or VBScript automatically when a system event occurs, enabling persistence on a compromised host. The detection relies on process creation telemetry, specifically the Image path for scrcons.exe and the ParentImage path for svchost.exe.

Reporting behind it

Related detections9 linkedT1546.003 — drag to rearrange

Malicious WMI Registration - PowerShell (via powershell)

Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)

Windows WMI Event Consumer with Encoded Payload Containing Suspicious Strings

PowerShell WMI Event Subscription Persistence via New-CimInstance

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Windows Security 4624 Logon for scrcons.exe Indicating Remote WMI ActiveScriptEventConsumers

WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Windows WMI Script Event Consumer Execution via scrcons.exe

Pivot detection · T1546.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-wmi-script-event-consumer-execution-via-scrcons-exe-ec1d5e28

title: Windows WMI Script Event Consumer Execution via scrcons.exe
id: 910e6caa-5d3c-46cf-ae43-afc241a55a1f
status: test
description: This rule matches process creation of scrcons.exe when it is launched with svchost.exe as the parent, indicating execution of a WMI script event consumer. Attackers can use script event consumers to run JScript or VBScript automatically when a system event occurs, enabling persistence on a compromised host. The detection relies on process creation telemetry, specifically the Image path for scrcons.exe and the ParentImage path for svchost.exe.
references:
  - https://redcanary.com/blog/threat-detection/child-processes/
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmi_persistence_script_event_consumer.yml
author: Thomas Patzke, Huntrule Team
date: 2018-03-07
modified: 2022-10-11
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: C:\WINDOWS\system32\wbem\scrcons.exe
    ParentImage: C:\Windows\System32\svchost.exe
  condition: selection
falsepositives:
  - Legitimate event consumers
  - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button
level: medium
license: DRL-1.1
related:
  - id: ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL