Windows File Events: ScreenConnect SlashAndGrab Exploitation Dropper Artifacts

title: "Windows File Events: ScreenConnect SlashAndGrab Exploitation Dropper Artifacts"
id: a67347b6-c0a9-472f-845a-4c153633ab9d
status: test
description: This rule flags Windows file creation or write events where the target path matches specific ScreenConnect-related artifacts associated with SlashAndGrab exploitation. Attackers may use these files to stage payloads and establish follow-on execution, so identifying these exact filenames and directories can help surface active compromise. The detection relies on file event telemetry containing TargetFilename values matching the hardcoded path patterns.
references:
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/SlashAndGrab-Exploitation-In-Wild/file_event_win_apt_unknown_exploitation_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
tags:
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    - TargetFilename|contains|all:
        - C:\Windows\Temp\ScreenConnect\
        - \LB3.exe
    - TargetFilename|contains:
        - C:\mpyutd.msi
        - C:\perflogs\RunSchedulerTaskOnce.ps1
        - C:\ProgramData\1.msi
        - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mpyutd.msi
        - C:\ProgramData\update.dat
        - C:\Users\oldadmin\Documents\MilsoftConnect\Files\ta.exe
        - C:\Windows\Help\Help\SentinelAgentCore.dll
        - C:\Windows\Help\Help\SentinelUI.exe
        - C:\Windows\spsrv.exe
        - C:\Windows\Temp\svchost.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 05164d17-8e11-4d7d-973e-9e4962436b87
    type: derived