Sigma rule: Potential Remote WMI ActiveScriptEventConsumers Activity

Rule

Title

Potential Remote WMI ActiveScriptEventConsumers Activity

Status

test

Level

medium

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Date

2020-09-02

Modified

2024-09-02

File

rules-threat-hunting/windows/builtin/security/account_management/win_security_scrcons_remote_wmi_scripteventconsumer.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network.
This event is best correlated and used as an enrichment to determine the potential lateral movement activity.

Log source

product

windows

service

security

Detection

selection:
    EventID: 4624
    LogonType: 3
    ProcessName|endswith: 'scrcons.exe'
filter_main_local_system:
    TargetLogonId: '0x3e7' # Local System
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• SCCM

Tags

• attack.lateral-movement
• attack.privilege-escalation
• detection.threat-hunting
• attack.persistence
• attack.t1546.003

MITRE ATT&CK ids this rule names

• T1546.003

References

• https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/builtin/security/account_management/win_security_scrcons_remote_wmi_scripteventconsumer.yml