Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution

Title: Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
Status: test
Description:Detects potentially suspicious child processes launched via the ScreenConnect client service.
References:
  -https://www.mandiant.com/resources/telegram-malware-iranian-espionage
  -https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
  -https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  -https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale
Date: 2022-02-25
modified:2024-02-28
Tags:

• -'attack.command-and-control'
• -'attack.t1219.002'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    ParentCommandLine|contains|all:
      -':\Windows\TEMP\ScreenConnect\'
      -'run.cmd'

    Image|endswith:
      -'\bitsadmin.exe'
      -'\cmd.exe'
      -'\curl.exe'
      -'\dllhost.exe'
      -'\net.exe'
      -'\nltest.exe'
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\rundll32.exe'
      -'\wevtutil.exe'

  condition:selection
Falsepositives:
  -If the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed.
Level: medium