Title:Remote Access Tool - ScreenConnect Remote Command Execution Status:test Description:Detects the execution of a system command via the ScreenConnect RMM service. References: -https://github.com/SigmaHQ/sigma/pull/4467 Author: Ali Alwashali Date: 2023-10-10 modified:2024-02-26 Tags:
-'attack.execution'
-'attack.t1059.003'
Logsource:
category: process_creation
product: windows
Detection: selection_parent: ParentImage|endswith:
'\ScreenConnect.ClientService.exe' selection_img: Image|endswith:'\cmd.exe'OriginalFileName:'Cmd.Exe'selection_cli: CommandLine|contains:
'\TEMP\ScreenConnect\' condition:all of selection_* Falsepositives:
-Legitimate use of ScreenConnect. Disable this rule if ScreenConnect is heavily used. Level:low
