Remote Access Tool - ScreenConnect Installation Execution

Title: Remote Access Tool - ScreenConnect Installation Execution
Status: test
Description:Detects ScreenConnect program starts that establish a remote access to a system.
References:
  -https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies
Author: Florian Roth (Nextron Systems)
Date: 2021-02-11
modified:2024-02-26
Tags:

• -'attack.persistence'
• -'attack.initial-access'
• -'attack.t1133'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'e=Access&'
      -'y=Guest&'
      -'&p='
      -'&c='
      -'&k='

  condition:selection
Falsepositives:
  -Legitimate use by administrative staff
Level: medium