ScreenConnect Temporary Installation Artefact Creation (Windows File Events)

title: ScreenConnect Temporary Installation Artefact Creation (Windows File Events)
id: f13f4802-2f23-45a0-89f0-0c7dd34e3f38
status: test
description: This rule matches Windows file creation or modification events where the target path contains "\Bin\ScreenConnect." indicating a ScreenConnect temporary installation artefact. Attackers can abuse legitimate remote access/support software to establish interactive access to systems, so spotting these artefacts can help identify suspicious software staging. The detection relies on Windows file event telemetry and specifically the recorded target filename/path substring.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_artefact.yml
author: frack113, Huntrule Team
date: 2022-02-13
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: \Bin\ScreenConnect.
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: fec96f39-988b-4586-b746-b93d59fd1922
    type: derived