Analytics BIOC Informational
✕

Scrcons.exe Rare Child Process

The Windows Management Instrumentation (WMI) standard event consumer scrcons.exe executed a rare VBScript or PowerShell script. Executing a rare script can be an indication of local or remote code execution abuse by an attacker.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Execution (TA0002) Persistence (TA0003)
ATT&CK techniques: Windows Management Instrumentation (T1047) Event Triggered Execution: Windows Management Instrumentation Event Subscription (T1546.003)
Attacker's goals:

The attacker is trying to gain Persistence via WMI script registration.

Investigative actions:

Search for any executions of the Managed Object Format (MOF) compiler mofcomp.exe and review the process that ran it. Review registered WMI ActiveScriptEventConsumer by running "WMIC /namespace:\root\default path ActiveScriptEventConsumer get *".

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Scrcons.exe Rare Child Process Medium (parent: Informational)