{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/attack.t1546.003/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["attack.persistence","attack.privilege-escalation","attack.t1546.003","windows"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis threat brief identifies file activity involving \u003ccode\u003escrcons.exe\u003c/code\u003e, the WMI Script Event Consumer, which is associated with WMI persistence techniques. The detection relies on monitoring file events generated by the \u003ccode\u003eC:\\WINDOWS\\system32\\wbem\\scrcons.exe\u003c/code\u003e process.\u003c/p\u003e\n\u003ch2 id=\"false-positives\"\u003eFalse Positives\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDell Power Manager (C:\\Program Files\\Dell\\PowerManager\\DpmPowerPlanSetup.exe)\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T02:46:10Z","date_published":"2026-11-10T02:46:10Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wmi-script-event-consumer/","summary":"Detection of file writes associated with the WMI script event consumer process (scrcons.exe).","title":"WMI Persistence - Script Event Consumer File Write","url":"https://feed.craftedsignal.io/briefs/2026-11-wmi-script-event-consumer/"}],"language":"en","title":"CraftedSignal Threat Feed - Attack.t1546.003","version":"https://jsonfeed.org/version/1.1"}