{"id":"7b582f1a-b318-4c6a-bf4e-66fe49bf55a5","title":"Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution","description":"Detects potentially suspicious child processes launched via the ScreenConnect client service.\n","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale","status":"test","level":"medium","date":"2022-02-25","modified":"2024-02-28","tags":["attack.command-and-control","attack.t1219.002"],"technique_ids":["T1219.002"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["If the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed."],"references":["https://www.mandiant.com/resources/telegram-malware-iranian-espionage","https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode","https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708","https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html"],"source_path":"rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml","source_sha256":"f899c2d70066d2b05dec7ca628b6fec544c0a1393fefab9ab5a996802b8b7d24","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution\nid: 7b582f1a-b318-4c6a-bf4e-66fe49bf55a5\nrelated:\n    - id: d1a401ab-8c47-4e86-a7d8-2460b6a53e4a\n      type: derived\nstatus: test\ndescription: |\n    Detects potentially suspicious child processes launched via the ScreenConnect client service.\nreferences:\n    - https://www.mandiant.com/resources/telegram-malware-iranian-espionage\n    - https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode\n    - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708\n    - https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale\ndate: 2022-02-25\nmodified: 2024-02-28\ntags:\n    - attack.command-and-control\n    - attack.t1219.002\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentCommandLine|contains|all:\n            - ':\\Windows\\TEMP\\ScreenConnect\\'\n            - 'run.cmd'\n        Image|endswith:\n            - '\\bitsadmin.exe'\n            - '\\cmd.exe'\n            - '\\curl.exe'\n            - '\\dllhost.exe'\n            - '\\net.exe'\n            - '\\nltest.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\rundll32.exe'\n            - '\\wevtutil.exe'\n    condition: selection\nfalsepositives:\n    - If the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1219.002","id":"T1219.002","name":"Remote Desktop Software","page":"techniques/enterprise/T1219.002/"}],"data_path":"data/detection-rules/7b582f1a-b318-4c6a-bf4e-66fe49bf55a5.json","kind":"sigma"}