
title: Script Event Consumer Spawning Process
author: Sittikorn S
date: 2021/06/21
description: Detects a suspicious child process of Script Event Consumer (scrcons.exe).
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    ParentImage:
    - '*\scrcons.exe'
  SELECTION_3:
    Image:
    - '*\svchost.exe'
    - '*\dllhost.exe'
    - '*\powershell.exe'
    - '*\wscript.exe'
    - '*\cscript.exe'
    - '*\schtasks.exe'
    - '*\regsvr32.exe'
    - '*\mshta.exe'
    - '*\rundll32.exe'
    - '*\msiexec.exe'
    - '*\msbuild.exe'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- unknown
fields:
- CommandLine
- ParentCommandLine
id: f6d1dd2f-b8ce-40ca-bc23-062efb686b34
level: high
logsource:
  category: process_creation
  product: windows
references:
- https://redcanary.com/blog/child-processes/
- https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html
status: experimental
tags:
- attack.execution
- attack.t1047
ruletype: SIGMA
