Rogue ScreenConnect Worm: VBScript Persistence via Public\Libraries Staging Directory

Arnold Chan@slaz

•updated Sep 9, 2026•0•0•0

Detects Run key persistence pointing to the known VBScript staging directory (C:\Users\Public\Libraries\Default\Lib\Lib1) used by the worm-like ScreenConnect campaign (Aug 2026), matching known script filenames (WindowsServiceHost.vbs, 1.vbs-4.vbs) invoked via wscript.exe/cscript.exe.