MSI Install to Service Start Timing Gap (~180s) for ScreenConnect/RMM Installers Evading Correlation Windows

Duo Tech@duotech

•updated Aug 5, 2026•2•0•13

Detects the SMOKE#SCREEN loader.cs technique of inserting a ~180 second delay between ScreenConnect/RMM MSI installation and the resulting service start, deliberately used to break EDR/SIEM correlation windows.