ScreenConnect Deployment and C2 Communication Correlation

Lacey Cochrane@NullVectorX

•updated Feb 3, 2026•5•0•51

This rule correlates the deployment of ScreenConnect components (identified by specific process names and image paths) with subsequent network communication to a known ScreenConnect C2 server (meeting.bulletmailer.net on port 8041). It aims to detect suspicious ScreenConnect activity, potentially indicating unauthorized remote access or control.