ScreenConnect User Database Modification

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•25

Detects file modifications to the temporary XML user database file in the ScreenConnect server. This activity can indicate local user modification, potentially as part of the exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8. It may also be observed during legitimate modifications to local users or permissions within ScreenConnect.