# Active Script Event Consumers

## Overview

**Evidence:** WMI Active Script\
**Description:** Dump WMI Active Script Event Consumers\
**Category:** System\
**Platform:** windows\
**Short Name:** wmiasc\
**Is Parsed:** Yes\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** No

## Background

WMI ActiveScript Event Consumers execute VBScript or JScript code when specific WMI events occur. This is a powerful persistence mechanism that allows attackers to run arbitrary scripts with SYSTEM privileges in response to system events.

ActiveScript consumers are particularly dangerous because they don't require a file on disk (fileless persistence) and run with high privileges.

## Data Collected

This collector gathers structured data about wmi active script.

### WMI Active Script Data

| Field                 | Description      | Example                                         |
| --------------------- | ---------------- | ----------------------------------------------- |
| `Name`                | Consumer name    | MaliciousConsumer                               |
| `PayloadScriptEngine` | Scripting engine | VBScript                                        |
| `PayloadScriptText`   | Script code      | Set objShell = CreateObject("WScript.Shell")... |

## Collection Method

This collector queries WMI for ActiveScriptEventConsumer instances in multiple namespaces:

* `ROOT\Subscription`
* `ROOT\DEFAULT`
* `ROOT\CIMV2`

## Forensic Value

ActiveScript consumers are a common advanced persistence technique. Investigators use this data to detect WMI script-based persistence, identify malicious VBScript/JScript payloads, and track fileless malware techniques.
