Remote Access Tool - ScreenConnect Server Web Shell Execution
Detects potential web shell execution originating from the ScreenConnect server process. This rule specifically looks for the ScreenConnect.Service.exe spawning cmd.exe or csc.exe, which could indicate an attacker leveraging a compromised ScreenConnect server to execute arbitrary commands or compile code.
Sigma
