All Detections

ScreenConnect Execution from Temp

avatar
Ankit Mehta@Secvyn
updated Jun 12, 2026001

Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.

Microsoft Sentinel (KQL)