ScreenConnect - SlashAndGrab Exploitation Indicators

 1title: ScreenConnect - SlashAndGrab Exploitation Indicators
 2id: 05164d17-8e11-4d7d-973e-9e4962436b87
 3status: test
 4description: |
 5        Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect as reported Team Huntress
 6references:
 7    - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
 8author: Nasreddine Bencherchali (Nextron Systems)
 9date: 2024-02-23
10tags:
11    - attack.defense-evasion
12    - detection.emerging-threats
13logsource:
14    product: windows
15    category: file_event
16detection:
17    selection:
18        - TargetFilename|contains|all:
19              - 'C:\Windows\Temp\ScreenConnect\'
20              - '\LB3.exe'
21        - TargetFilename|contains:
22              - 'C:\mpyutd.msi'
23              - 'C:\perflogs\RunSchedulerTaskOnce.ps1'
24              - 'C:\ProgramData\1.msi'
25              - 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mpyutd.msi'
26              - 'C:\ProgramData\update.dat'
27              - 'C:\Users\oldadmin\Documents\MilsoftConnect\Files\ta.exe'
28              - 'C:\Windows\Help\Help\SentinelAgentCore.dll'
29              - 'C:\Windows\Help\Help\SentinelUI.exe'
30              - 'C:\Windows\spsrv.exe'
31              - 'C:\Windows\Temp\svchost.exe'
32    condition: selection
33falsepositives:
34    - Unknown
35level: high