Suspicious ConnectWise Session Launch Without Common TLD
Detects potentially rogue or self-hosted ConnectWise Control (ScreenConnect) session launches based on suspicious query string patterns in the command line. Specifically flags sessions that include parameters like `e=...&y=...&h=...&p=...` but where the `h=` (host) value does not include common trusted TLDs. May indicate use of unauthorized remote access tools. Investigative Tip: Sandboxing or running the strings command against the binary will reveal the embedded host parameter if you really want to be sure.
Sigma
