ScreenConnect Client Installation Detection
This rule detects the installation or execution of ScreenConnect client software. It looks for specific keywords in the process command line, folder paths, or file names associated with ScreenConnect. The rule also attempts to categorize the risk level based on the installation path, flagging installations in temporary directories or downloads as 'High Risk'.
Microsoft Sentinel (KQL)
