Cryptojacking via ScreenConnect - Vcredist masquerade dropping ScreenConnect

Ibrahim Saud@tektrix

•updated Jun 19, 2026•5•0•5

This rule detects cryptojacking activity where a silent MSI execution, masquerading as a vcredist_x64.dll load, is used to install and run ScreenConnect. This specific pattern has been observed in campaigns abusing ScreenConnect for GPU mining cryptojacking.