SilentCanvas - Custom Port ScreenConnect Beaconing
Detects the malicious ScreenConnect module beaconing to attacker-controlled C2 infrastructure on custom ports 5443/8041. This rule specifically looks for network connections initiated by a process identified as 'ScreenConnect' to these non-standard ports, indicating potential command and control activity.
Microsoft Sentinel (KQL)
