WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Status: test
Severity: medium
Log source: category image_load, product windows
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source: github.com/SigmaHQ/sigma

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Known false positives

Legitimate event consumers
Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546.003` Event Triggered Execution: Windows Management Instrumentation Event Subscription
Privilege Escalation	`T1546.003` Event Triggered Execution: Windows Management Instrumentation Event Subscription

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule body

title: WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
id: b439f47d-ef52-4b29-9a2f-57d8a96cb6b8
status: test
description: Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
references:
    - https://twitter.com/HunterPlaybook/status/1301207718355759107
    - https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/
    - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-09-02
modified: 2023-02-22
tags:
    - attack.lateral-movement
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.003
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\scrcons.exe'
        ImageLoaded|endswith:
            - '\vbscript.dll'
            - '\wbemdisp.dll'
            - '\wshom.ocx'
            - '\scrrun.dll'
    condition: selection
falsepositives:
    - Legitimate event consumers
    - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\scrcons.exe'
    ImageLoaded|endswith:
        - '\vbscript.dll'
        - '\wbemdisp.dll'
        - '\wshom.ocx'
        - '\scrrun.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\scrcons.exe` corpus 9 (sigma 9)	`field:"Image" kind:ends_with value:"\scrcons.exe"`
`ImageLoaded`	ends_with	`\scrrun.dll` `\vbscript.dll` corpus 3 (sigma 3) `\wbemdisp.dll` `\wshom.ocx`	`field:"ImageLoaded" kind:ends_with`