ScreenConnect Client with Multiple 'c=' Custom Fields
Detects a ScreenConnect client launched with several repeated c= custom fields, which can carry attacker configuration and campaign metadata. This behavior has been observed in cryptojacking campaigns abusing ScreenConnect.
Cortex XDR
