ScreenConnect File Transfer Activity

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•24

Detects when files are transferred using the ScreenConnect Remote Monitoring and Management (RMM) tool. This activity can indicate an adversary using legitimate tools for data exfiltration or staging.