{"id":"ebef4391-1a81-4761-a40a-1db446c0e625","title":"NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE","description":"Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE.\nAn ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that\nautomatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.\nAdversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-06-25","modified":"2026-06-19","tags":["attack.privilege-escalation","attack.persistence","attack.t1546.003"],"technique_ids":["T1546.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate software creating script event consumers"],"references":["https://twitter.com/johnlatwc/status/1408062131321270282?s=12","https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml","source_sha256":"7ec9e93adcedd77b59b275e0d9615efc8bc0bdcb1b37e5920baa847b4fc1a03c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE\nid: ebef4391-1a81-4761-a40a-1db446c0e625\nstatus: test\ndescription: |\n    Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE.\n    An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that\n    automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs.\n    Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.\nreferences:\n    - https://twitter.com/johnlatwc/status/1408062131321270282?s=12\n    - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-06-25\nmodified: 2026-06-19\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1546.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - OriginalFileName: 'wmic.exe'\n        - Image|endswith: '\\WMIC.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'ActiveScriptEventConsumer'\n            - ' CREATE '\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate software creating script event consumers\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.003","id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","page":"techniques/enterprise/T1546.003/"}],"data_path":"data/detection-rules/ebef4391-1a81-4761-a40a-1db446c0e625.json","kind":"sigma"}