Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of a. Logsource: windows / process_creation. Rule: title: WMI Persistence - Script Event Consumer id: ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e status: test description: 'Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance and will execute registered JScript or VBScript code as a result. Script event consumers are a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse script event consumers to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs. ' references: - https://redcanary.com/blog/threat-detection/child-processes/ - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Thomas Patzke date: 2018-03-07 modified: 2022-10-11 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: category: process_creation product: windows detection: selection: Image: C:\WINDOWS\system32\wbem\scrcons.exe ParentImage: C:\Windows\System32\svchost.exe condition: selection falsepositives: - Legitimate event consumers - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button level: medium
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Wow6432Node CurrentVersion Autorun Keys Modification id: b29aed60-ebd1-442b-9cb5-16a1d0324adb related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d - https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/ author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_wow_current_version_base: TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion selection_wow_current_version_keys: TargetObject|contains: - \ShellServiceObjectDelayLoad - \Run\ - \RunOnce\ - \RunOnceEx\ - \RunServices\ - \RunServicesOnce\ - \Explorer\ShellServiceObjects - \Explorer\ShellIconOverlayIdentifiers - \Explorer\ShellExecuteHooks - \Explorer\SharedTaskScheduler - \Explorer\Browser Helper Objects filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_ms_win_desktop_runtime: Details|startswith: '"C:\ProgramData\Package Cache\{d21a4f20-968a-4b0c-bf04-a38da5f06e41}\windowsdesktop-runtime-' filter_main_vcredist: Image|endswith: \VC_redist.x64.exe Details|endswith: '}\VC_redist.x64.exe" /burn.runonce' filter_main_upgrades: Image|startswith: - C:\ProgramData\Package Cache - C:\Windows\Temp\ Image|contains: - \winsdksetup.exe - \windowsdesktop-runtime- - \AspNetCoreSharedFrameworkBundle- Details|endswith: ' /burn.runonce' filter_main_uninstallers: Image|startswith: C:\Windows\Installer\MSI TargetObject|contains: \Explorer\Browser Helper Objects filter_main_msiexec: Image: C:\WINDOWS\system32\msiexec.exe TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ filter_main_edge: Image|contains|all: - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ - \setup.exe filter_optional_msoffice1: Image: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe TargetObject|contains: \Office\ClickToRun\REGISTRY\MACHINE\Software\Wow64