ScreenConnect Remote Access Tool Execution
This rule detects the execution of ScreenConnect, a legitimate remote access tool. Adversaries often abuse such tools to establish persistent command and control (C2) channels, move laterally within a network, and maintain access to compromised systems. The detection is based on specific product and company metadata associated with the ScreenConnect executable.
Sigma
