Cryptojacking - ScreenConnect Malicious Client Beacon (T1071.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Identifies the compromised ScreenConnect.ClientService.exe initiating network traffic to a known malicious command and control (C2) server associated with cryptojacking activities. The detection specifically looks for connections to 'directdownload.icu' or the IP address '193.42.11.108'.