Possible Remote Access Utility - ScreenConnect Temporary File (via file_event)

title: Possible Remote Access Utility - ScreenConnect Temporary File (via file_event)
id: 1ce137c4-ef11-55ca-b189-5988c1dffc5b
status: stable
description: This rule detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
references:
    - https://attack.mitre.org/techniques/T1059/003/
    - https://github.com/SigmaHQ/sigma/pull/4467
author: Huntrule Team
date: 2026-04-09
tags:
    - attack.execution
    - attack.t1059.003
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\ScreenConnect.WindowsClient.exe'
        TargetFilename|contains: '\Documents\ConnectWiseControl\Temp\'
    condition: selection
falsepositives:
    - Unknown
level: low