All Detections

ScreenConnect Execution from Temp

avatar
Ankit Mehta@Secvyn
updated Apr 10, 20262601,043

Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.

Microsoft Sentinel (KQL)