Rogue ScreenConnect client registered as persistence service
This rule detects the installation or modification of ScreenConnect services on Windows endpoints. It monitors for the creation of services using 'sc.exe', process commands related to ScreenConnect setup executables, or registry modifications and service installations associated with specific ScreenConnect identifiers, often indicative of unauthorized remote management software installation.
Microsoft Sentinel (KQL)
