ScreenConnect ClientService Installed/Invoked with Suspicious Relay Parameters
Detects the execution of ScreenConnect (ConnectWise) remote support client processes with command line arguments indicative of a remote session initiation (e.g., Guest access connection). This pattern is often used by adversaries to establish persistence or remote control of compromised systems.
Cortex XDR
