SilentCanvas - Encrypted Command-and-Control Communication (T1573)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Tracks communication from ScreenConnect to attacker infrastructure over non-standard ports (5443/8041). This rule specifically looks for network connections initiated by 'ScreenConnect.ClientService.exe' to remote ports 5443 or 8041, which are associated with the SilentCanvas campaign's encrypted command-and-control communication.