title: WMI Persistence - Script Event Consumer
id: ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e
status: test
description: Detects WMI script event consumers
author: Thomas Patzke
references:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
date: 2018/03/07
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: C:\WINDOWS\system32\wbem\scrcons.exe
    ParentImage: C:\Windows\System32\svchost.exe
  condition: selection
falsepositives:
  - Legitimate event consumers
level: high
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1546.003
