Title:
WMI Persistence - Script Event Consumer
Status:
test
Description:Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance
and will execute registered JScript or VBScript code as a result.
Script event consumers are a built-in Windows Management Instrumentation (WMI) class that
automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.
Adversaries often abuse script event consumers to maintain persistence on a compromised host
by executing a malicious script whenever a specific event occurs.
References:
-https://redcanary.com/blog/threat-detection/child-processes/
-https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
Author: Thomas Patzke
Date: 2018-03-07
modified:2022-10-11
Tags:
- -'attack.persistence'
- -'attack.privilege-escalation'
- -'attack.t1546.003'
Logsource:
- category: process_creation
- product: windows
Detection:
selection:
Image:
'C:\WINDOWS\system32\wbem\scrcons.exe'
ParentImage:
'C:\Windows\System32\svchost.exe'
condition:
selection
Falsepositives:
-Legitimate event consumers
-Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button
Level:
medium
