STAC3725 QEMU Defense Evasion via ScreenConnect and Local Admin Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•9•0•8

Detects anomalous activities associated with the CitrixBleed2 campaign where the ScreenConnect remote access tool is used to deploy or execute QEMU virtual machine artifacts. The rule monitors for the spawning of virtualization binaries (e.g., qemu-system-x86_64) via the ScreenConnect service, the dropping of QEMU-related files into ScreenConnect directories, and the suspicious creation of local administrator accounts (CtxAppVCOMService).