Suspicious ScreenConnect Client Child Process

  1[metadata]
  2creation_date = "2024/03/27"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate
 11execution abusing unauthorized access to the ScreenConnect remote access software.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.sysmon_operational-*",
 22    "winlogbeat-*",
 23]
 24language = "eql"
 25license = "Elastic License v2"
 26name = "Suspicious ScreenConnect Client Child Process"
 27note = """## Triage and analysis
 28
 29> **Disclaimer**:
 30> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 31
 32### Investigating Suspicious ScreenConnect Client Child Process
 33
 34ScreenConnect, a remote access tool, facilitates legitimate remote support but can be exploited by adversaries to execute unauthorized commands. Malicious actors may spawn processes like PowerShell or cmd.exe via ScreenConnect to perform harmful activities. The detection rule identifies such suspicious child processes, focusing on unusual arguments and process names, indicating potential abuse of remote access capabilities.
 35
 36### Possible investigation steps
 37
 38- Review the parent process name to confirm it is one of the ScreenConnect client processes listed in the query, such as ScreenConnect.ClientService.exe or ScreenConnect.WindowsClient.exe, to verify the source of the suspicious activity.
 39- Examine the child process name and arguments, such as powershell.exe with encoded commands or cmd.exe with /c, to identify potentially malicious actions or commands being executed.
 40- Check the network activity associated with the suspicious process, especially if the process arguments include network-related terms like *http* or *downloadstring*, to determine if there is any unauthorized data exfiltration or command and control communication.
 41- Investigate the user account under which the suspicious process was executed to assess if the account has been compromised or is being misused.
 42- Correlate the event with other security alerts or logs from data sources like Elastic Defend or Microsoft Defender XDR to gather additional context and identify any related malicious activities.
 43- Review the system's recent activity and changes, such as new scheduled tasks or services created by schtasks.exe or sc.exe, to identify any persistence mechanisms that may have been established by the attacker.
 44
 45### False positive analysis
 46
 47- Legitimate IT support activities using ScreenConnect may trigger the rule when executing scripts or commands for maintenance. To manage this, identify and whitelist specific IT support accounts or IP addresses that regularly perform these actions.
 48- Automated scripts or scheduled tasks that use ScreenConnect for routine operations might be flagged. Review and document these scripts, then create exceptions for known benign processes and arguments.
 49- Software updates or installations initiated through ScreenConnect can appear suspicious. Maintain a list of approved software and update processes, and exclude these from the rule.
 50- Internal security tools or monitoring solutions that leverage ScreenConnect for legitimate purposes may be detected. Verify these tools and add them to an exclusion list to prevent false positives.
 51- Training sessions or demonstrations using ScreenConnect to showcase command-line tools could be misinterpreted as threats. Ensure these sessions are logged and recognized as non-threatening, and adjust the rule to accommodate these scenarios.
 52
 53### Response and remediation
 54
 55- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the attacker.
 56- Terminate any suspicious processes identified in the alert, such as PowerShell, cmd.exe, or other flagged executables, to halt any ongoing malicious activity.
 57- Review and revoke any unauthorized user accounts or privileges that may have been created or modified using tools like net.exe or schtasks.exe.
 58- Conduct a thorough scan of the affected system using endpoint protection tools to identify and remove any malware or unauthorized software installed by the attacker.
 59- Restore the system from a known good backup if any critical system files or configurations have been altered or compromised.
 60- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
 61- Implement enhanced monitoring and logging for ScreenConnect and other remote access tools to detect similar activities in the future, ensuring that alerts are promptly reviewed and acted upon."""
 62references = [
 63    "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708",
 64]
 65risk_score = 47
 66rule_id = "78de1aeb-5225-4067-b8cc-f4a1de8a8546"
 67severity = "medium"
 68tags = [
 69    "Domain: Endpoint",
 70    "OS: Windows",
 71    "Use Case: Threat Detection",
 72    "Tactic: Command and Control",
 73    "Resources: Investigation Guide",
 74    "Data Source: Elastic Endgame",
 75    "Data Source: Elastic Defend",
 76    "Data Source: Sysmon",
 77    "Data Source: SentinelOne",
 78    "Data Source: Microsoft Defender XDR",
 79    "Data Source: Windows Security Event Logs",
 80    "Data Source: Crowdstrike",
 81    "Noise: Medium",
 82    "Performance: Normal",
 83    "Profile: Recommended",
 84    "Threat: Remote Management Tool Abuse",
 85    "Threat: Living off the Land",
 86    "Rule Type: Event Correlation (EQL)",
 87    "Platform: Windows",
 88]
 89timestamp_override = "event.ingested"
 90type = "eql"
 91
 92query = '''
 93process where host.os.type == "windows" and event.type == "start" and
 94  process.parent.name :
 95                ("ScreenConnect.ClientService.exe",
 96                 "ScreenConnect.WindowsClient.exe",
 97                 "ScreenConnect.WindowsBackstageShell.exe",
 98                 "ScreenConnect.WindowsFileManager.exe") and
 99  (
100   (process.name : "powershell.exe" and
101    process.args : ("-enc", "-ec", "-e", "*downloadstring*", "*Reflection.Assembly*", "*http*")) or
102   (process.name : "cmd.exe" and process.args : "/c") or
103   (process.name : "net.exe" and process.args : "/add") or
104   (process.name : "schtasks.exe" and process.args : ("/create", "-create")) or
105   (process.name : "sc.exe" and process.args : "create") or
106   (process.name : "rundll32.exe" and not process.args : "url.dll,FileProtocolHandler") or
107   (process.name : "msiexec.exe" and process.args : ("/i", "-i") and
108    process.args : ("/q", "/quiet", "/qn", "-q", "-quiet", "-qn", "-Q+")) or
109   process.name : ("mshta.exe", "certutil.exe", "bitsadmin.exe", "certreq.exe", "wscript.exe", "cscript.exe", "curl.exe",
110                   "ssh.exe", "scp.exe", "wevtutil.exe", "wget.exe", "wmic.exe")
111   )
112'''
113
114setup = """## Setup
115
116This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
117
118Setup instructions: https://ela.st/install-elastic-defend
119
120### Additional data sources
121
122This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
123
124- [CrowdStrike](https://ela.st/crowdstrike-integration)
125- [Microsoft Defender XDR](https://ela.st/m365-defender)
126- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
127- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
128- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
129"""
130
131
132[[rule.threat]]
133framework = "MITRE ATT&CK"
134
135[[rule.threat.technique]]
136id = "T1105"
137name = "Ingress Tool Transfer"
138reference = "https://attack.mitre.org/techniques/T1105/"
139
140[[rule.threat.technique]]
141id = "T1219"
142name = "Remote Access Tools"
143reference = "https://attack.mitre.org/techniques/T1219/"
144
145[rule.threat.tactic]
146id = "TA0011"
147name = "Command and Control"
148reference = "https://attack.mitre.org/tactics/TA0011/"
149
150[[rule.threat]]
151framework = "MITRE ATT&CK"
152
153[[rule.threat.technique]]
154id = "T1218"
155name = "System Binary Proxy Execution"
156reference = "https://attack.mitre.org/techniques/T1218/"
157
158[[rule.threat.technique.subtechnique]]
159id = "T1218.005"
160name = "Mshta"
161reference = "https://attack.mitre.org/techniques/T1218/005/"
162
163[[rule.threat.technique.subtechnique]]
164id = "T1218.007"
165name = "Msiexec"
166reference = "https://attack.mitre.org/techniques/T1218/007/"
167
168[[rule.threat.technique.subtechnique]]
169id = "T1218.011"
170name = "Rundll32"
171reference = "https://attack.mitre.org/techniques/T1218/011/"
172
173[rule.threat.tactic]
174id = "TA0005"
175name = "Defense Evasion"
176reference = "https://attack.mitre.org/tactics/TA0005/"
177
178[[rule.threat]]
179framework = "MITRE ATT&CK"
180
181[[rule.threat.technique]]
182id = "T1047"
183name = "Windows Management Instrumentation"
184reference = "https://attack.mitre.org/techniques/T1047/"
185
186[[rule.threat.technique]]
187id = "T1059"
188name = "Command and Scripting Interpreter"
189reference = "https://attack.mitre.org/techniques/T1059/"
190
191[[rule.threat.technique.subtechnique]]
192id = "T1059.001"
193name = "PowerShell"
194reference = "https://attack.mitre.org/techniques/T1059/001/"
195
196[[rule.threat.technique.subtechnique]]
197id = "T1059.003"
198name = "Windows Command Shell"
199reference = "https://attack.mitre.org/techniques/T1059/003/"
200
201[[rule.threat.technique.subtechnique]]
202id = "T1059.005"
203name = "Visual Basic"
204reference = "https://attack.mitre.org/techniques/T1059/005/"
205
206[rule.threat.tactic]
207id = "TA0002"
208name = "Execution"
209reference = "https://attack.mitre.org/tactics/TA0002/"
210
211[[rule.threat]]
212framework = "MITRE ATT&CK"
213
214[[rule.threat.technique]]
215id = "T1053"
216name = "Scheduled Task/Job"
217reference = "https://attack.mitre.org/techniques/T1053/"
218
219[[rule.threat.technique.subtechnique]]
220id = "T1053.005"
221name = "Scheduled Task"
222reference = "https://attack.mitre.org/techniques/T1053/005/"
223
224[[rule.threat.technique]]
225id = "T1543"
226name = "Create or Modify System Process"
227reference = "https://attack.mitre.org/techniques/T1543/"
228
229[[rule.threat.technique.subtechnique]]
230id = "T1543.003"
231name = "Windows Service"
232reference = "https://attack.mitre.org/techniques/T1543/003/"
233
234[rule.threat.tactic]
235id = "TA0003"
236name = "Persistence"
237reference = "https://attack.mitre.org/tactics/TA0003/"