Script Event Consumer Spawning Process

Title: Script Event Consumer Spawning Process
Status: test
Description:Detects a suspicious child process of Script Event Consumer (scrcons.exe).
References:
  -https://redcanary.com/blog/child-processes/
  -https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html
Author: Sittikorn S
Date: 2021-06-21
modified:2022-07-14
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\scrcons.exe'
    Image|endswith:
      -'\svchost.exe'
      -'\dllhost.exe'
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\wscript.exe'
      -'\cscript.exe'
      -'\schtasks.exe'
      -'\regsvr32.exe'
      -'\mshta.exe'
      -'\rundll32.exe'
      -'\msiexec.exe'
      -'\msbuild.exe'

  condition:selection
Falsepositives:
  -Unknown
Level: high