Remote Access Tool - ScreenConnect File Transfer

Title: Remote Access Tool - ScreenConnect File Transfer
Status: test
Description:Detects file being transferred via ScreenConnect RMM
References:
  -https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling
  -https://github.com/SigmaHQ/sigma/pull/4467
Author: Ali Alwashali
Date: 2023-10-10
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059.003'

Logsource:

• service: application
• product: windows

Detection:
  selection:
    Provider_Name: 'ScreenConnect'
    EventID: '201'
    Data|contains: 'Transferred files with action'
  condition:selection
Falsepositives:
  -Legitimate use of ScreenConnect
Level: low