ScreenConnect RMM temporary file creation in Windows user Documents\ConnectWiseControl\Temp

Flags file writes to ScreenConnect’s ConnectWiseControl\Temp staging directory from ScreenConnect.WindowsClient.exe.

FreeUnreviewedSigmalowv1

screenconnect-rmm-temporary-file-creation-in-windows-user-documents-connectwisec-0afecb6e

title: ScreenConnect RMM temporary file creation in Windows user Documents\ConnectWiseControl\Temp
id: 9babb952-af30-4628-9577-0f3f192ade4f
related:
  - id: b1f73849-6329-4069-bc8f-78a604bb8b23
    type: similar
  - id: 0afecb6e-6223-4a82-99fb-bf5b981e92a5
    type: derived
status: test
description: This rule identifies creation of files under the ScreenConnect RMM staging path in a Windows user profile. An attacker using ScreenConnect can remotely execute binaries, which are first dropped into the ConnectWiseControl\Temp directory before execution. The detection relies on file event telemetry capturing the creating process image and the target filename path containing the expected temporary directory.
references:
  - https://github.com/SigmaHQ/sigma/pull/4467
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_remote_file.yml
author: Ali Alwashali, Huntrule Team
date: 2023-10-10
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \ScreenConnect.WindowsClient.exe
    TargetFilename|contains: \Documents\ConnectWiseControl\Temp\
  condition: selection
falsepositives:
  - Legitimate use of ScreenConnect
level: low
license: DRL-1.1

What it detects

This rule identifies creation of files under the ScreenConnect RMM staging path in a Windows user profile. An attacker using ScreenConnect can remotely execute binaries, which are first dropped into the ConnectWiseControl\Temp directory before execution. The detection relies on file event telemetry capturing the creating process image and the target filename path containing the expected temporary directory.

Known false positives

Legitimate use of ScreenConnect

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.