DNS query to actor-controlled ScreenConnect C2 domain (MSP360/ScreenConnect dual-RMM chain)

Arnold Chan@slaz

•updated 6 days ago•0•0•0

Detects DNS queries and TLS SNI traffic directed at known actor-controlled domains and subdomains associated with ScreenConnect remote management software usage in malicious RMM chains.