Remote Access Tool - ScreenConnect Command Execution

Title: Remote Access Tool - ScreenConnect Command Execution
Status: test
Description:Detects command execution via ScreenConnect RMM
References:
  -https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling
  -https://github.com/SigmaHQ/sigma/pull/4467
Author: Ali Alwashali
Date: 2023-10-10
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059.003'

Logsource:

• service: application
• product: windows

Detection:
  selection:
    Provider_Name: 'ScreenConnect'
    EventID: '200'
    Data|contains: 'Executed command of length'
  condition:selection
Falsepositives:
  -Legitimate use of ScreenConnect
Level: low