Sigma rule: WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Rule

Title

WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Status

test

Level

medium

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Date

2020-09-02

Modified

2023-02-22

File

rules/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Log source

product

windows

category

image_load

Detection

selection:
    Image|endswith: '\scrcons.exe'
    ImageLoaded|endswith:
        - '\vbscript.dll'
        - '\wbemdisp.dll'
        - '\wshom.ocx'
        - '\scrrun.dll'
condition: selection

False positives (as the rule lists them)

• Legitimate event consumers
• Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button

Tags

• attack.lateral-movement
• attack.privilege-escalation
• attack.persistence
• attack.t1546.003

MITRE ATT&CK ids this rule names

• T1546.003

References

• https://twitter.com/HunterPlaybook/status/1301207718355759107
• https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/
• https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml