scrcons.exe
Sources: 300M+ executions observed in the wild.
Summary
WMI Standard Event Consumer (Script Consumer). Executes scripts in response to WMI event subscriptions. A key component of WMI-based persistence — when an attacker creates a WMI event subscription with a script consumer, scrcons.exe is the process that runs the malicious script.
scrcons.exe is the 1743rd most commonly executed Windows program in EchoTrail's dataset, observed 460 times across enterprise environments. It typically runs from C:\Windows\System32\wbem and it is most often launched by svchost.exe.
Get this in your tools
The same record for scrcons.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/scrcons.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System32\wbem100%
Top Hashes (SHA256)
- 3ea7f6348c8783d810353f2961e1e7ee82e8dfa1366a1d65dc38eeb0a1866ae684.57%
- 6d92af5931fef0b6ff7980d49be6a9a2035d4984bc2a39df43cf7c73093179249.35%
- 688d4afc0874b4f4d1ed7066428271572b9698ac1d63fd70690a28088665e52a5%
- 4da3e6f87ccfd5d32a17d3cb6a5bb5b9ffd069fd92a96a6fb155f998581ab4a11.09%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- svchost.exe100%
Security Analysis
What does scrcons.exe normally do?
Runs from C:\Windows\System32\wbem. Very rarely seen in normal operation — most environments have zero legitimate WMI script event consumers. When it does run, it executes VBScript or JScript defined in a WMI ActiveScriptEventConsumer.
When is scrcons.exe suspicious?
Any execution of scrcons.exe is suspicious in most environments. Spawning cmd.exe, powershell.exe, or cscript.exe/wscript.exe. Making network connections. Writing files to disk.
How do attackers abuse scrcons.exe?
WMI PERSISTENCE: Attackers create a WMI event subscription with three components: an event filter (trigger condition, e.g., system startup), an event consumer (ActiveScriptEventConsumer with malicious VBScript/JScript), and a binding between them. When the trigger fires, scrcons.exe executes the script. This persists across reboots with no files on disk and no obvious autorun registry entries. This is a fileless persistence mechanism that survives reboots. The script lives in the WMI repository (OBJECTS.DATA file), not as a file on disk. Used by APT29, APT28, Turla, and other sophisticated threat actors.
Detection guidance
HIGH-CONFIDENCE DETECTIONS: - Any scrcons.exe execution (very rare legitimately) - scrcons.exe spawning child processes (cmd.exe, powershell.exe, etc.) - WMI event subscription creation (Sysmon Event ID 19/20/21) PROACTIVE HUNTING: - Query WMI for ActiveScriptEventConsumer instances: Get-WmiObject -Namespace root\subscription -Class ActiveScriptEventConsumer DATA SOURCES: WMI events (Sysmon 19/20/21), process creation (Sysmon 1)
False positive notes
Some enterprise monitoring tools create WMI event subscriptions for hardware monitoring. HP and Dell management agents occasionally use WMI consumers. These are identifiable by their script content and filter conditions.
Related Processes
Ask Rocky about scrcons.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for scrcons.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.