scrcons.exe
Summary
WMI Standard Event Consumer (Script Consumer). Executes scripts in response to WMI event subscriptions. A key component of WMI-based persistence — when an attacker creates a WMI event subscription with a script consumer, scrcons.exe is the process that runs the malicious script.
scrcons.exe is the 1743rd most commonly executed Windows program in EchoTrail's dataset, observed 460 times across enterprise environments. It typically runs from C:\Windows\System32\wbem and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System32\wbem100%
Top Hashes (SHA256)
- 3ea7f6348c8783d810353f2961e1e7ee82e8dfa1366a1d65dc38eeb0a1866ae684.57%
- 6d92af5931fef0b6ff7980d49be6a9a2035d4984bc2a39df43cf7c73093179249.35%
- 688d4afc0874b4f4d1ed7066428271572b9698ac1d63fd70690a28088665e52a5%
- 4da3e6f87ccfd5d32a17d3cb6a5bb5b9ffd069fd92a96a6fb155f998581ab4a11.09%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- svchost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does scrcons.exe normally do?
Runs from C:\Windows\System32\wbem. Very rarely seen in normal operation — most environments have zero legitimate WMI script event consumers. When it does run, it executes VBScript or JScript defined in a WMI ActiveScriptEventConsumer.
When is scrcons.exe suspicious?
Any execution of scrcons.exe is suspicious in most environments. Spawning cmd.exe, powershell.exe, or cscript.exe/wscript.exe. Making network connections. Writing files to disk.
How do attackers abuse scrcons.exe?
WMI PERSISTENCE: Attackers create a WMI event subscription with three components: an event filter (trigger condition, e.g., system startup), an event consumer (ActiveScriptEventConsumer with malicious VBScript/JScript), and a binding between them. When the trigger fires, scrcons.exe executes the script. This persists across reboots with no files on disk and no obvious autorun registry entries. This is a fileless persistence mechanism that survives reboots. The script lives in the WMI repository (OBJECTS.DATA file), not as a file on disk. Used by APT29, APT28, Turla, and other sophisticated threat actors.
Detection guidance
HIGH-CONFIDENCE DETECTIONS: - Any scrcons.exe execution (very rare legitimately) - scrcons.exe spawning child processes (cmd.exe, powershell.exe, etc.) - WMI event subscription creation (Sysmon Event ID 19/20/21) PROACTIVE HUNTING: - Query WMI for ActiveScriptEventConsumer instances: Get-WmiObject -Namespace root\subscription -Class ActiveScriptEventConsumer DATA SOURCES: WMI events (Sysmon 19/20/21), process creation (Sysmon 1)
False positive notes
Some enterprise monitoring tools create WMI event subscriptions for hardware monitoring. HP and Dell management agents occasionally use WMI consumers. These are identifiable by their script content and filter conditions.
Related Processes
Ask Rocky about scrcons.exe
Rocky answers questions about scrcons.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.