Link: ScreenConnect remote access tool delivery with unattended guest access

calendar Jul 21, 2026  ·
Share on: linkedin copy

Detects inbound messages containing ScreenConnect links that direct recipients to download a Guest Access installer (.msi or .exe). The links use ScreenConnect's integration parameters specifying Guest session type and Access mode, indicating unsolicited remote access tool deployment. Lures observed include fake invoices, payment proofs, event invitations, and social gathering notifications — often urging recipients to open the link on a Windows desktop and install the downloaded file.

Sublime rule (View on GitHub)

 1name: "Link: ScreenConnect remote access tool delivery with unattended guest access"
 2description: "Detects inbound messages containing ScreenConnect links that direct recipients to download a Guest Access installer (.msi or .exe). The links use ScreenConnect's integration parameters specifying Guest session type and Access mode, indicating unsolicited remote access tool deployment. Lures observed include fake invoices, payment proofs, event invitations, and social gathering notifications — often urging recipients to open the link on a Windows desktop and install the downloaded file."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // at least one link to screenconnect
 8  and length(filter(body.links,
 9                    .href_url.domain.root_domain == "screenconnect.com"
10                    // exclude tenant_domains (if the customer users screenconnect and has their own subdomain)
11                    and .href_url.domain.domain not in $tenant_domains
12             )
13  ) > 0
14  // all the screenconnect links include an msi/exe with Guesst Access
15  and all(filter(body.links, .href_url.domain.root_domain == "screenconnect.com"),
16          strings.iends_with(.href_url.path, '.msi', '.exe')
17          // https://docs.connectwise.com/ScreenConnect_Documentation/Developers/Integration_guide
18          // e = SessionType. Support, Meet, or Access
19          and strings.icontains(.href_url.query_params, "e=Access")
20          // y = ProcessType (host vs guest)
21          and strings.icontains(.href_url.query_params, "y=Guest")
22  )  
23attack_types:
24  - "Malware/Ransomware"
25tactics_and_techniques:
26  - "Social engineering"
27  - "Out of band pivot"
28detection_methods:
29  - "URL analysis"
30  - "Content analysis"
31id: "ed0e62be-7385-522b-ac10-6636b0b2c0de"
to-top