Windows WMI Script Event Consumer Execution via scrcons.exe

Flags scrcons.exe starting under svchost.exe, indicating WMI script event consumer execution that can support persistence.

FreeUnreviewedSigmamediumv1

windows-wmi-script-event-consumer-execution-via-scrcons-exe-ec1d5e28

title: Windows WMI Script Event Consumer Execution via scrcons.exe
id: 910e6caa-5d3c-46cf-ae43-afc241a55a1f
status: test
description: This rule matches process creation of scrcons.exe when it is launched with svchost.exe as the parent, indicating execution of a WMI script event consumer. Attackers can use script event consumers to run JScript or VBScript automatically when a system event occurs, enabling persistence on a compromised host. The detection relies on process creation telemetry, specifically the Image path for scrcons.exe and the ParentImage path for svchost.exe.
references:
  - https://redcanary.com/blog/threat-detection/child-processes/
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmi_persistence_script_event_consumer.yml
author: Thomas Patzke, Huntrule Team
date: 2018-03-07
modified: 2022-10-11
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: C:\WINDOWS\system32\wbem\scrcons.exe
    ParentImage: C:\Windows\System32\svchost.exe
  condition: selection
falsepositives:
  - Legitimate event consumers
  - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button
level: medium
license: DRL-1.1
related:
  - id: ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e
    type: derived

What it detects

This rule matches process creation of scrcons.exe when it is launched with svchost.exe as the parent, indicating execution of a WMI script event consumer. Attackers can use script event consumers to run JScript or VBScript automatically when a system event occurs, enabling persistence on a compromised host. The detection relies on process creation telemetry, specifically the Image path for scrcons.exe and the ParentImage path for svchost.exe.

Known false positives

Legitimate event consumers
Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.