Skip to content
Threat Feed
Subscribe
high advisory

WMI Persistence - Script Event Consumer File Write

Detection of file writes associated with the WMI script event consumer process (scrcons.exe).

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Sources
2 public sources
Freshness
Revision 1Nov 10, 02:46 UTC
Detection
1 rule
Source quality
A2Roughly even chance

This threat brief identifies file activity involving scrcons.exe, the WMI Script Event Consumer, which is associated with WMI persistence techniques. The detection relies on monitoring file events generated by the C:\WINDOWS\system32\wbem\scrcons.exe process.

False Positives

  • Dell Power Manager (C:\Program Files\Dell\PowerManager\DpmPowerPlanSetup.exe)

Detection coverage 1

WMI Persistence - Script Event Consumer File Write

high
sigma sources: file_event, windows

Detection queries are available on the platform. Get full rules →