Link: ScreenConnect remote access tool delivery with unattended guest access

calendar Sep 11, 2026  ·
Share on: linkedin copy

Detects inbound messages containing ScreenConnect links that direct recipients to download a Guest Access installer (.msi or .exe). The links use ScreenConnect's integration parameters specifying Guest session type and Access mode, indicating unsolicited remote access tool deployment. Lures observed include fake invoices, payment proofs, event invitations, and social gathering notifications — often urging recipients to open the link on a Windows desktop and install the downloaded file.

Sublime rule (View on GitHub)

 1name: "Link: ScreenConnect remote access tool delivery with unattended guest access"
 2description: "Detects inbound messages containing ScreenConnect links that direct recipients to download a Guest Access installer (.msi or .exe). The links use ScreenConnect's integration parameters specifying Guest session type and Access mode, indicating unsolicited remote access tool deployment. Lures observed include fake invoices, payment proofs, event invitations, and social gathering notifications — often urging recipients to open the link on a Windows desktop and install the downloaded file."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // at least one link to screenconnect
 8  and any(body.links,
 9          strings.iends_with(.href_url.path, '.msi', '.exe')
10          // https://docs.connectwise.com/ScreenConnect_Documentation/Developers/Integration_guide
11          // e = SessionType. Support, Meet, or Access
12          and strings.icontains(.href_url.query_params, "e=Access")
13          // y = ProcessType (host vs guest)
14          and strings.icontains(.href_url.query_params, "y=Guest")
15          // exclude tenant_domains (if the customer users screenconnect and has their own subdomain)
16          and .href_url.domain.domain not in $tenant_domains
17  )  
18attack_types:
19  - "Malware/Ransomware"
20tactics_and_techniques:
21  - "Social engineering"
22  - "Out of band pivot"
23detection_methods:
24  - "URL analysis"
25  - "Content analysis"
26id: "ed0e62be-7385-522b-ac10-6636b0b2c0de"
to-top