Remote Access Tool - ScreenConnect Server Web Shell Execution

Title: Remote Access Tool - ScreenConnect Server Web Shell Execution
Status: test
Description:Detects potential web shell execution from the ScreenConnect server process.
References:
  -https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
  -https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Author: Jason Rathbun (Blackpoint Cyber)
Date: 2024-02-26
modified:None
Tags:

• -'attack.initial-access'
• -'attack.t1190'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    ParentImage|endswith: '\ScreenConnect.Service.exe'
    Image|endswith:
      -'\cmd.exe'
      -'\csc.exe'

  condition:selection
Falsepositives:
  -Unlikely
Level: high