ScreenConnect User Database Modification

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•21

This rule detects file modifications to the temporary XML user database file within the ScreenConnect server. Such modifications can indicate local user changes, which may occur during the exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions prior to 23.9.8. Legitimate modifications to local users or permissions within ScreenConnect can also trigger this detection. This rule requires Advanced Auditing to log successful Windows Event ID 4663 events and a System Access Control List (SACL) set on the relevant ScreenConnect directory.