Windows: ScreenConnect Temporary File Creation in ConnectWiseControl Temp
Flags file writes to ScreenConnect’s ConnectWiseControl\Temp staging directory from ScreenConnect.WindowsClient.exe.
- Product
- windows
- Category
- file_event
- Author
- Ali Alwashali (SigmaHQ), DRL 1.1
- Published
- 2023-10-10
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches file creation events where the process image ends with ScreenConnect.WindowsClient.exe and the target filename contains the ConnectWiseControl Temp directory under the user Documents path. Attackers abusing ScreenConnect for remote execution commonly drop temporary binaries into this location before running them, so this telemetry can highlight suspicious staging activity. It relies on Windows file event logs that provide both the creating process image and the target filename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: ScreenConnect Temporary File Creation in ConnectWiseControl Temp"
id: 9babb952-af30-4628-9577-0f3f192ade4f
related:
- id: b1f73849-6329-4069-bc8f-78a604bb8b23
type: similar
- id: 0afecb6e-6223-4a82-99fb-bf5b981e92a5
type: derived
status: test
description: This rule matches file creation events where the process image ends with ScreenConnect.WindowsClient.exe and the target filename contains the ConnectWiseControl Temp directory under the user Documents path. Attackers abusing ScreenConnect for remote execution commonly drop temporary binaries into this location before running them, so this telemetry can highlight suspicious staging activity. It relies on Windows file event logs that provide both the creating process image and the target filename.
references:
- https://github.com/SigmaHQ/sigma/pull/4467
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_remote_file.yml
author: Ali Alwashali, Huntrule Team
date: 2023-10-10
tags:
- attack.execution
- attack.t1059.003
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \ScreenConnect.WindowsClient.exe
TargetFilename|contains: \Documents\ConnectWiseControl\Temp\
condition: selection
falsepositives:
- Legitimate use of ScreenConnect
level: low
license: DRL-1.1