ScreenConnect Client Spawned By Browser Or Email Client
Detects instances where a ScreenConnect client or installer process is spawned by a web browser or email client. This behavior is indicative of a social engineering attack where a user is tricked into downloading and executing a rogue Remote Monitoring and Management (RMM) tool.
Sigma
