WMI Script Event Consumer File Write by scrcons.exe
This rule detects file write operations performed by 'scrcons.exe' (WMI Scripting Host). This activity is indicative of WMI persistence mechanisms, specifically the creation or modification of WMI script event consumers. Adversaries often use WMI event subscriptions to establish persistence and execute arbitrary code when a defined event occurs, such as system startup or user logon. The detection focuses on the 'Image' field, looking for the specific WMI scripting host executable.
Sigma
