Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
83
18
11
7
6
Contributors
34
25
14
11
11
Categories
80
44
39
36
33
Platforms
127
7
2
1
Products / Services
72
17
13
8
6
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
10
9
IDS Classtypes
2
1
IDS Protocols
2
1
This rule detects instances where the Faronics Deploy Agent process initiates the installation or download of ScreenConnect remote access software via PowerShell or the Windows Installer (msiexec.exe). This pattern is often indicative of authorized RMM deployment, but it is also a common tactic for adversaries to establish persistent remote access to endpoints.
This rule detects instances where the Faronics Deploy Agent process initiates the installation or download of ScreenConnect remote access software via PowerShell or the Windows Installer (msiexec.exe). This pattern is often indicative of authorized RMM deployment, but it is also a common tactic for adversaries to establish persistent remote access to endpoints.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
Detects instances where the ScreenConnect ClientService process initiates a child process that is not a recognized ScreenConnect binary. It further filters for child processes created shortly after a file has been created or modified by the ScreenConnect service, which is often indicative of an adversary using the remote access tool to drop and execute malicious payloads.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects when the ScreenConnect remote administration client process spawns common command-line or scripting interpreters. This behavior is indicative of an interactive session or remote command execution performed via the ScreenConnect tool, which is frequently abused by threat actors for lateral movement and remote control.
Detects the execution of common command-line and scripting tools initiated by ScreenConnect (ConnectWise) remote administration processes. This pattern often indicates unauthorized remote access, lateral movement, or post-compromise activity where legitimate administrative software is abused to run arbitrary commands.
Detects instances where the ScreenConnect remote access client processes perform file creation or modification actions that are not preceded by or correlated with legitimate session activity logs (such as 'SessionConfirmed' or 'TransferFiles') within a 5-minute window. This behavior may indicate an unauthorized remote session or abuse of the remote access tool.
Detects instances where the ScreenConnect remote support client initiates outbound network connections to an unusually high number of distinct remote IP addresses (greater than 5). This behavior is characteristic of unauthorized lateral movement, reconnaissance, or establishing multiple C2 tunnels via a legitimate RMM tool.
Detects instances where permissions related to file transfers are granted or accessed within a ScreenConnect remote access session. This rule monitors for session-related events or permission updates that could indicate an attacker leveraging the remote access tool to exfiltrate data or interact with the filesystem.
Detects when ScreenConnect client processes (ClientService.exe or WindowsClient.exe) spawn child processes that are not part of the standard ScreenConnect application suite. This behavior is indicative of unauthorized use of remote access tools for command execution or lateral movement.
This rule detects the execution, file creation, or registry modification associated with specific ScreenConnect (ConnectWise Control) installation artifacts that align with known suspicious deployment patterns. It monitors for binaries and configuration artifacts that may indicate the unauthorized installation or persistence of remote administration tools.
Detects the use of ScreenConnect client processes initiating rapid outbound network connections to multiple distinct devices within a short timeframe (1 hour). This behavior is often indicative of unauthorized lateral movement, automated discovery, or mass-deployment of remote access sessions using legitimate administrative software.
Detects file creation events initiated by ScreenConnect (ConnectWise Control) client processes. ScreenConnect is a legitimate remote support and RMM tool often leveraged by adversaries for remote access or as a secondary persistence mechanism. Monitoring file creation by these processes may indicate the installation of additional tools, scripts, or malware via a remote support session.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects suspicious file transfer and subsequent execution activity associated with the ScreenConnect (ConnectWise Control) remote access application, which may indicate exploitation of file-transfer vulnerabilities. The rule monitors for ScreenConnect processes dropping executable or script files to disk followed by the spawning of command interpreters to execute those files.
Detects suspicious file transfer and subsequent execution activity associated with the ScreenConnect (ConnectWise Control) remote access application, which may indicate exploitation of file-transfer vulnerabilities. The rule monitors for ScreenConnect processes dropping executable or script files to disk followed by the spawning of command interpreters to execute those files.
Detects suspicious file transfer and subsequent execution activity associated with the ScreenConnect (ConnectWise Control) remote access application, which may indicate exploitation of file-transfer vulnerabilities. The rule monitors for ScreenConnect processes dropping executable or script files to disk followed by the spawning of command interpreters to execute those files.
Detects suspicious file transfer and subsequent execution activity associated with the ScreenConnect (ConnectWise Control) remote access application, which may indicate exploitation of file-transfer vulnerabilities. The rule monitors for ScreenConnect processes dropping executable or script files to disk followed by the spawning of command interpreters to execute those files.
Page 2 of 7