WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load — Detection Rule

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Read the full analysis on IntelFusions