Defender exclusion then silent ScreenConnect MSI install

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•5

Detects a sequence where a Windows Defender exclusion is added via PowerShell or Command Prompt, followed by a silent installation of an 'app.msi' package on the same device within 30 minutes. Management agents and noisy administrative devices are filtered out to reduce false positives.