{"id":"b439f47d-ef52-4b29-9a2f-57d8a96cb6b8","title":"WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load","description":"Detects signs of the WMI script host process \"scrcons.exe\" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-09-02","modified":"2023-02-22","tags":["attack.lateral-movement","attack.privilege-escalation","attack.persistence","attack.t1546.003"],"technique_ids":["T1546.003"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Legitimate event consumers","Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button"],"references":["https://twitter.com/HunterPlaybook/status/1301207718355759107","https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/","https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html"],"source_path":"rules/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml","source_sha256":"7396aeee228ffa66c18f2298d4344e50dc04897870072eb715c6191ce2e5eb63","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load\nid: b439f47d-ef52-4b29-9a2f-57d8a96cb6b8\nstatus: test\ndescription: Detects signs of the WMI script host process \"scrcons.exe\" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.\nreferences:\n    - https://twitter.com/HunterPlaybook/status/1301207718355759107\n    - https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/\n    - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2020-09-02\nmodified: 2023-02-22\ntags:\n    - attack.lateral-movement\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1546.003\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\scrcons.exe'\n        ImageLoaded|endswith:\n            - '\\vbscript.dll'\n            - '\\wbemdisp.dll'\n            - '\\wshom.ocx'\n            - '\\scrrun.dll'\n    condition: selection\nfalsepositives:\n    - Legitimate event consumers\n    - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.003","id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","page":"techniques/enterprise/T1546.003/"}],"data_path":"data/detection-rules/b439f47d-ef52-4b29-9a2f-57d8a96cb6b8.json","kind":"sigma"}