ScreenConnect ClientService installed as fake 'Microsoft Update Service' with C2 to r.servermanagemen.xyz
Detects the execution of ScreenConnect.ClientService.exe with command line arguments containing 'servermanagemen' or 'Microsoft Update Service'. This pattern is often associated with the use of ConnectWise (ScreenConnect) remote access software, which can be leveraged for legitimate administration or malicious remote control.
Cortex XDR
