Suspicious ScreenConnect Installation From Temp Directory
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory via msiexec.exe, indicating potential unauthorized deployment observed in an in-memory loader attack.
Sigma
