Silent ScreenConnect MSI Install via msiexec Followed by Agent File Drop
Detects msiexec.exe silently installing a ScreenConnect RMM MSI package (ScreenConnect.ClientSetup.msi, WindowsExplorerSupport.msi, SystemCheck.msi) with /qn or /quiet and /norestart flags, correlated with the subsequent drop of ScreenConnect agent binaries (Client.dll, ClientService.dll, WindowsClient.exe, WindowsCredentialProvider.dll) on the same device, indicating unauthorized/unattended RMM agent installation.
Microsoft Sentinel (KQL)
