ScreenConnect Remote Access Tool Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects the execution of ScreenConnect, a legitimate remote access tool, when it is used to establish a remote access session. The rule specifically looks for command-line arguments indicative of a guest connection to a ScreenConnect session.