Title:Remote Access Tool - ScreenConnect Temporary File Status:test Description:Detects the creation of files in a specific location by ScreenConnect RMM.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
References: -https://github.com/SigmaHQ/sigma/pull/4467 Author: Ali Alwashali Date: 2023-10-10 modified:None Tags:
-'attack.execution'
-'attack.t1059.003'
Logsource:
category: file_event
product: windows
Detection: selection: Image|endswith:
'\ScreenConnect.WindowsClient.exe' TargetFilename|contains:
'\Documents\ConnectWiseControl\Temp\' condition:selection Falsepositives:
-Legitimate use of ScreenConnect Level:low
