Detectionmediumtest
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)Created Wed Sep 02Updated Wed Feb 22b439f47d-ef52-4b29-9a2f-57d8a96cb6b8windows
Log Source
WindowsImage Load (DLL)
ProductWindows← raw: windows
CategoryImage Load (DLL)← raw: image_load
Detection Logic
Detection Logic1 selector
detection:
selection:
Image|endswith: '\scrcons.exe'
ImageLoaded|endswith:
- '\vbscript.dll'
- '\wbemdisp.dll'
- '\wshom.ocx'
- '\scrrun.dll'
condition: selectionFalse Positives
Legitimate event consumers
Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button
MITRE ATT&CK
Rule Metadata
Rule ID
b439f47d-ef52-4b29-9a2f-57d8a96cb6b8
Status
test
Level
medium
Type
Detection
Created
Wed Sep 02
Modified
Wed Feb 22
Path
rules/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml
Raw Tags
attack.lateral-movementattack.privilege-escalationattack.persistenceattack.t1546.003