WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Title: WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
Status: test
Description:Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
References:
  -https://twitter.com/HunterPlaybook/status/1301207718355759107
  -https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/
  -https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-09-02
modified:2023-02-22
Tags:

• -'attack.lateral-movement'
• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1546.003'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    Image|endswith: '\scrcons.exe'
    ImageLoaded|endswith:
      -'\vbscript.dll'
      -'\wbemdisp.dll'
      -'\wshom.ocx'
      -'\scrrun.dll'

  condition:selection
Falsepositives:
  -Legitimate event consumers
  -Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button
Level: medium