huntrule

WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)

Alerts when scrcons.exe loads vbscript/wbem/WMI script DLLs, suggesting WMI ActiveScriptEventConsumer activity.

FreeReviewedSigma · Medium · v2
Product
windows
Category
image_load
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published
2020-09-02
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags when the WMI script host process scrcons.exe loads specific scripting and WMI-related DLLs. Such DLL loads can indicate use of WMI ActiveScriptEventConsumers for event-driven execution, which is a common technique for persistence and lateral movement. It relies on Windows image load telemetry capturing the loaded module paths and file names for scrcons.exe.

Reporting behind it

Related detections9 linkedT1546.003 — drag to rearrange
Malicious WMI Registration - PowerShell (via powershell)
Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)
Windows WMI Event Consumer with Encoded Payload Containing Suspicious Strings
PowerShell WMI Event Subscription Persistence via New-CimInstance
Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt
Windows Security 4624 Logon for scrcons.exe Indicating Remote WMI ActiveScriptEventConsumers
Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution
Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)
Windows WMI Persistence via wbemcons.dll Loaded by WmiPrvSE.exe
WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)
Pivot detection · T1546.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.