ScreenConnect unauthorized file transfer via CVE-2026-84869

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•2

Detects unauthorized or potentially malicious file transfer activity within ScreenConnect sessions. The rule flags file transfers occurring on vulnerable versions of ScreenConnect (prior to 26.6.5), transfers that bypass user confirmation prompts, or instances where files are transferred and subsequently executed.