Vignesh Keshavan
@illusion070 followers10 downloads9 copies0 likes33 views
4 detections
Filters
Last updated
All Time
Detection languages
2
2
Categories
4
2
1
1
1
Platforms
4
Products / Services
1
1
1
MITRE Techniques
2
2
2
1
1
This rule detects the execution, file creation, or registry modification associated with specific ScreenConnect (ConnectWise Control) installation artifacts that align with known suspicious deployment patterns. It monitors for binaries and configuration artifacts that may indicate the unauthorized installation or persistence of remote administration tools.
Detects MSBuild process execution originating from command shells loading obfuscated scripts or inline projects associated with PavinLoader.
This rule detects the installation or modification of ScreenConnect services on Windows endpoints. It monitors for the creation of services using 'sc.exe', process commands related to ScreenConnect setup executables, or registry modifications and service installations associated with specific ScreenConnect identifiers, often indicative of unauthorized remote management software installation.
Detects MSBuild process execution originating from command shells loading obfuscated scripts or inline projects associated with PavinLoader.