New ActiveScriptEventConsumer Created Via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

This rule detects the creation of an ActiveScriptEventConsumer via the `wmic.exe` command-line utility. Adversaries often use WMI event subscriptions to establish persistence or elevate privileges by executing malicious code when a specific event occurs. The presence of 'ActiveScriptEventConsumer' and 'CREATE' in the command line indicates an attempt to set up such a subscription.