NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE

SigmaHQ Detections@sigmaHQ

•updated Jun 19, 2026•0•0•0

Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.