Showboat - WMI ActiveScriptEventConsumer Persistence (T1546.003)
Detects the creation of ActiveScriptEventConsumer bindings via WMI process executions, a fileless persistence mechanism used by Showboat malware to survive reboots. The rule specifically looks for 'scrcons.exe' processes with command-line arguments containing 'ActiveScriptEventConsumer' or '__EventFilter'.
Microsoft Sentinel (KQL)
