ScreenConnect Installed via Azure Run Command

Ibrahim Saud@tektrix

•updated Jun 18, 2026•1•0•9

Detects the installation or execution of ScreenConnect originating from the Azure Run Command extension context. This indicates potential unauthorized remote access tool deployment.