Windows File Creation of ScreenConnect Temporary Installation Artefact
Flags Windows file events referencing temporary ScreenConnect artefacts under the \Bin\ScreenConnect.* path.
- Product
- windows
- Category
- file_event
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-13
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches Windows file system events where the target filename contains the path segment '\Bin\ScreenConnect.' indicating a ScreenConnect-related temporary installation artefact. Such artefacts can appear when interactive remote access software is installed or staged, which attackers may use to establish command-and-control capability while blending with legitimate tooling. Detection relies on file event telemetry that records the target filename for the activity.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_artefact.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows File Creation of ScreenConnect Temporary Installation Artefact
id: f13f4802-2f23-45a0-89f0-0c7dd34e3f38
status: test
description: This rule matches Windows file system events where the target filename contains the path segment '\Bin\ScreenConnect.' indicating a ScreenConnect-related temporary installation artefact. Such artefacts can appear when interactive remote access software is installed or staged, which attackers may use to establish command-and-control capability while blending with legitimate tooling. Detection relies on file event telemetry that records the target filename for the activity.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_artefact.yml
author: frack113, Huntrule Team
date: 2022-02-13
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: \Bin\ScreenConnect.
condition: selection
falsepositives:
- Legitimate use
level: medium
license: DRL-1.1
related:
- id: fec96f39-988b-4586-b746-b93d59fd1922
type: derived