All Detections

WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Sigma