APT 35 - Charming Kitten - G0059 — Magic Hound | LOLBin - ScreenConnect SetupWizard auth-bypass artifact + correlation
Detects potential exploitation of the ScreenConnect SetupWizard.aspx to bypass authentication and create unauthorized administrative users. The rule monitors for the creation or modification of User.xml or Users.xml files in the ScreenConnect application directories, correlating these file events with suspicious process activity (such as cmd.exe or powershell.exe) or web requests to the SetupWizard.aspx endpoint.
Microsoft Sentinel (KQL)
