ScreenConnect Suspicious Remote Command Execution
Detects potentially suspicious child processes launched via the ScreenConnect client service. This rule specifically looks for common Windows utilities being executed from a temporary ScreenConnect directory, which can indicate post-exploitation activity by an adversary using the remote access tool.
Sigma
