Ransomware/Lateral Movement Following ScreenConnect Session Activity

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•3

Detects anomalous post-exploitation behaviors such as mass file modifications, lateral movement (SMB/RDP), or persistence mechanisms (scheduled tasks/services) following ScreenConnect client session activity. This behavior is indicative of potential exploitation of ScreenConnect to deploy ransomware or move laterally within the network.