ScreenConnect - SlashAndGrab Exploitation Indicators

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•19

Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect (ConnectWise) as reported by Team Huntress. This rule specifically looks for the creation of known malicious files and paths associated with post-exploitation activities after successful exploitation of CVE-2024-1709 and CVE-2024-1708.