Potential ScreenConnect Credential Phishing Domain Connection

test User@testuser007

•updated Aug 26, 2025•6•0•105

This detection identifies network connections to domains that may be impersonating ConnectWise or ScreenConnect for credential harvesting purposes. The logic is based on tactics observed in the MCTO3030 campaign which used domains with specific country-code TLDs or generic "connectwise" and "screenconnect" themes.