WMI ActiveScriptEventConsumer Activity Indications via scrcons.exe Loading Script/COM DLLs (Windows)

Alerts when scrcons.exe loads vbscript/wbem/WMI script DLLs, suggesting WMI ActiveScriptEventConsumer activity.

FreeUnreviewedSigmamediumv1

wmi-activescripteventconsumer-activity-indications-via-scrcons-exe-loading-scrip-b439f47d

title: WMI ActiveScriptEventConsumer Activity Indications via scrcons.exe Loading Script/COM DLLs (Windows)
id: fe8e2611-c0fc-40d2-a8ae-e716dedadfa6
status: test
description: This rule identifies instances where the Windows script host process scrcons.exe loads scripting- and WMI-related libraries such as vbscript.dll, wbemdisp.dll, wshom.ocx, and scrrun.dll. Loading these DLLs can indicate WMI ActiveScriptEventConsumer-based event consumer execution, which is a common persistence and lateral movement technique. It relies on image load telemetry that captures process image names and the DLL file paths being loaded.
references:
  - https://twitter.com/HunterPlaybook/status/1301207718355759107
  - https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/
  - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-09-02
modified: 2023-02-22
tags:
  - attack.lateral-movement
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.003
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \scrcons.exe
    ImageLoaded|endswith:
      - \vbscript.dll
      - \wbemdisp.dll
      - \wshom.ocx
      - \scrrun.dll
  condition: selection
falsepositives:
  - Legitimate event consumers
  - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button
level: medium
license: DRL-1.1
related:
  - id: b439f47d-ef52-4b29-9a2f-57d8a96cb6b8
    type: derived

What it detects

This rule identifies instances where the Windows script host process scrcons.exe loads scripting- and WMI-related libraries such as vbscript.dll, wbemdisp.dll, wshom.ocx, and scrrun.dll. Loading these DLLs can indicate WMI ActiveScriptEventConsumer-based event consumer execution, which is a common persistence and lateral movement technique. It relies on image load telemetry that captures process image names and the DLL file paths being loaded.

Known false positives

Legitimate event consumers
Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.