Attack.t1546.003 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/attack.t1546.003/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 02:46:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWMI Persistence - Script Event Consumer File Writehttps://feed.craftedsignal.io/briefs/2026-11-wmi-script-event-consumer/Tue, 10 Nov 2026 02:46:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-wmi-script-event-consumer/Detection of file writes associated with the WMI script event consumer process (scrcons.exe).This threat brief identifies file activity involving scrcons.exe, the WMI Script Event Consumer, which is associated with WMI persistence techniques. The detection relies on monitoring file events generated by the C:\WINDOWS\system32\wbem\scrcons.exe process.

False Positives

  • Dell Power Manager (C:\Program Files\Dell\PowerManager\DpmPowerPlanSetup.exe)
]]>highadvisoryattack.persistenceattack.privilege-escalationattack.t1546.003windows