ScreenConnect client spawning child process (CVE-2026-84869)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

Detects when ScreenConnect client processes (ClientService.exe or WindowsClient.exe) spawn child processes that are not part of the standard ScreenConnect application suite. This behavior is indicative of unauthorized use of remote access tools for command execution or lateral movement.