ActiveScriptEventConsumer

ActiveScriptEventConsumer is one of the five standard event consumer classes that Windows ships in the root\subscription namespace. When the event filter it is bound to fires, it runs a script. ScriptingEngine names the language, VBScript or JScript; the code is either stored inline in ScriptText or read from the file named by ScriptFilename. The script runs inside scrcons.exe as SYSTEM, and KillTimeout can limit how long it may run.

Why it matters in investigations

Few legitimate products use a script consumer, so any instance deserves a careful read of the script itself, not only of its name. With ScriptText, the whole payload lives inside OBJECTS.DATA: there is no script file on disk for a scanner to find, and no Run key, service or scheduled task pointing to it. From there the script can download a second stage, start a process through WScript.Shell or write files, all with SYSTEM rights.

On the host, the most useful lead is scrcons.exe running at all, and especially starting children such as powershell.exe or cmd.exe. In the repository, the script is an ordinary string in the instance's heap, so it can be read from a live record or from a deleted one.

Example

A script consumer as it would be registered with a MOF file (names and payload are illustrative):

#pragma namespace("\\\\.\\root\\subscription")

instance of ActiveScriptEventConsumer as $Cons
{
    Name = "UpdCheck";
    ScriptingEngine = "VBScript";
    ScriptText = "Set s = CreateObject(\"WScript.Shell\") : s.Run \"powershell -nop -w hidden -enc JAB...\", 0";
};

Bound to a filter on logon or system uptime, this runs a hidden, encoded PowerShell command every time the trigger matches. When you find one, decode the payload, then check the binding, the filter's query and the CreatorSID of each object to see which account registered it.

Related terms

• Event consumer (__EventConsumer)
• CommandLineEventConsumer
• scrcons.exe
• __FilterToConsumerBinding
• OBJECTS.DATA

WMI Parser lists every script consumer in a collected repository, live or recovered, with its full properties. For the whole subscription model, read WMI event subscription persistence explained.