Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
83
18
11
7
6
Contributors
34
25
14
11
11
Categories
80
44
39
36
33
Platforms
127
7
2
1
Products / Services
72
17
13
8
6
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
10
9
IDS Classtypes
2
1
IDS Protocols
2
1
Detects ScreenConnect/ConnectWise Control malware installer MSI and components
Detects the execution of a process named 'code.exe' or 'lightshot.exe' from a temporary directory.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
Detects emails containing threat-actor lure links to trojanized ScreenConnect MSI files, specifically targeting 'cld.pt' downloads with 'COMPROBANTE*.msi' patterns. The rule also looks for 'COMPROBANTE' keywords in email subjects as a fallback.
Detects the creation or execution of files matching known malicious SHA256 hashes associated with a weaponized ScreenConnect installer and a Rust-based loader. This rule identifies the presence of specific known malicious binaries on endpoints.
Detects the creation of executable files (.exe, .dll) in the `%TEMP%\Lightshot` directory. This directory is used as a staging area by the malicious fake Clawdbot VS Code extension to drop its payloads, including a weaponized ScreenConnect client.
This rule detects the creation of a process where the parent process is 'node.exe' (associated with Node.js, often used by VS Code extensions) and the child process is either 'ScreenConnect.ClientService.exe' or has 'ScreenConnect' in its command line. This behavior could indicate a VS Code extension spawning a ScreenConnect remote access tool, which might be malicious.
Detects instances where a ScreenConnect client or installer process is spawned by a web browser or email client. This behavior is indicative of a social engineering attack where a user is tricked into downloading and executing a rogue Remote Monitoring and Management (RMM) tool.
Detects the execution of ScreenConnect, a legitimate remote access tool, when it is used to establish a remote access session. The rule specifically looks for command-line arguments indicative of a guest connection to a ScreenConnect session.
The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via alternate paths or channels. It leverages Nginx access logs to identify web requests to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected ScreenConnect instance, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
Detects the execution of remote access, tunneling, and credential access tools from suspicious directories. This rule specifically targets tools commonly abused by threat actors like Scattered Spider, such as AnyDesk, TeamViewer, ngrok, Teleport, Tailscale, and Mimikatz, when executed from user-writable or temporary folders. It excludes legitimate installations in standard Program Files directories to reduce false positives.
Generic rule content from file: Masquerade - Suspicious ScreenConnect Install
Generic rule content from file: Initial Access - Probable Rogue ScreenConnect Session
KQL Query from file: RMM Hunting with Sentinel TI
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Detects potentially suspicious child processes launched via the ScreenConnect client service. This rule specifically looks for common Windows utilities being executed from a temporary ScreenConnect directory, which can indicate post-exploitation activity by an adversary using the remote access tool.
This rule detects the creation or modification of files containing the string '\Bin\ScreenConnect.' in their target filename. This pattern is indicative of temporary installation artifacts for ScreenConnect, a legitimate remote access tool that can be abused by adversaries for command and control or remote access. The rule aims to identify the presence of these artifacts, which could signal the installation or use of ScreenConnect on a system.
This rule detects the execution of ScreenConnect, a legitimate remote access tool. Adversaries often abuse such tools to establish persistent command and control (C2) channels, move laterally within a network, and maintain access to compromised systems. The detection is based on specific product and company metadata associated with the ScreenConnect executable.
This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability using Windows SACL EventCode 4663. It identifies path traversal attacks by monitoring file system events related to the ScreenConnect service. This activity is significant as it allows unauthorized access to sensitive files and directories, potentially leading to data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access to critical data or execute harmful code, compromising the integrity and security of the affected system. Immediate remediation by updating to version 23.9.8 or above is recommended.
This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability, which allows path traversal attacks by manipulating file_path and file_name parameters in the URL. It leverages the Endpoint datamodel Filesystem node to identify suspicious file system events, specifically targeting paths and filenames associated with ScreenConnect. This activity is significant as it can lead to unauthorized access to sensitive files and directories, potentially resulting in data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access and control over the host system, posing a severe security risk.
Page 6 of 7