Glossary
scrcons.exe (WMI Standard Event Consumer)
The Windows process that runs ActiveScriptEventConsumer scripts. Seeing it run, or its children, points to a WMI script subscription.
scrcons.exe, in C:\Windows\System32\wbem, is the WMI Standard Event Consumer host for scripting. When a permanent subscription whose consumer is an ActiveScriptEventConsumer fires, WMI starts scrcons.exe, which runs the consumer's VBScript or JScript as SYSTEM. It is a legitimate Windows binary; what matters is why it runs and what it does.
Why it matters in investigations
On most systems scrcons.exe rarely runs, because few legitimate products use script consumers. Its execution is therefore a useful lead in itself. Look for it in Prefetch (a SCRCONS.EXE prefetch file), in Amcache, in process creation events (Security event 4688 when process auditing is enabled, or Sysmon event 1) and in EDR telemetry. Child processes of scrcons.exe, such as powershell.exe, cmd.exe or rundll32.exe, point strongly to a malicious script consumer.
By contrast, command-line consumers do not use it: a CommandLineEventConsumer is started by the WMI provider host, WmiPrvSE.exe. Knowing which parent to look for tells you which kind of consumer to expect in the repository.
Example
A typical sequence to correlate (times are illustrative):
09:12:04 scrcons.exe starts (Prefetch, 4688)
09:12:05 powershell.exe -nop -w hidden -enc ... parent: scrcons.exe
When you see this, check the CIM repository for a script consumer and its binding, live or recovered, and read the script and the filter's query. Line the execution times up with the trigger: a filter on uptime fires shortly after boot, one on logon at each sign-in. Event ID 5861 and Sysmon events 19 to 21 can date the registration.
Related terms
WMI Parser shows every script consumer in a collected repository, with its script text. For the full workflow, see the WMI persistence investigation checklist.