ScreenConnect Temporary Installation Artifact Detection
This rule detects the creation or modification of files containing the string '\Bin\ScreenConnect.' in their target filename. This pattern is indicative of temporary installation artifacts for ScreenConnect, a legitimate remote access tool that can be abused by adversaries for command and control or remote access. The rule aims to identify the presence of these artifacts, which could signal the installation or use of ScreenConnect on a system.
Sigma
