Remote Access Tool - ScreenConnect Temporary File

calendar Feb 26, 2024 · attack.execution attack.t1059.003  ·
Share on: linkedin copy

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users<username>\Documents\ConnectWiseControl\Temp" before execution.

Sigma rule (View on GitHub)

 1title: Remote Access Tool - ScreenConnect Temporary File
 2id: 0afecb6e-6223-4a82-99fb-bf5b981e92a5
 3related:
 4    - id: b1f73849-6329-4069-bc8f-78a604bb8b23
 5      type: similar
 6status: experimental
 7description: |
 8    Detects the creation of files in a specific location by ScreenConnect RMM.
 9    ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.    
10references:
11    - https://github.com/SigmaHQ/sigma/pull/4467
12author: Ali Alwashali
13date: 2023/10/10
14tags:
15    - attack.execution
16    - attack.t1059.003
17logsource:
18    category: file_event
19    product: windows
20detection:
21    selection:
22        Image|endswith: '\ScreenConnect.WindowsClient.exe'
23        TargetFilename|contains: '\Documents\ConnectWiseControl\Temp\'
24    condition: selection
25falsepositives:
26    - Legitimate use of ScreenConnect
27# Note: Incase the level if ScreenConnect is not used
28level: low

References

Related rules

to-top