Suspicious ScreenConnect Service Launch
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
Microsoft Sentinel (KQL)
