Windows File Events Indicative of SlashAndGrab ScreenConnect Post-Exploitation
Alerts on Windows file activity writing known SlashAndGrab-related ScreenConnect artifact paths and executables.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-02-23
- Updated
- 2026-07-31
What it detects
This rule flags Windows file creation or access events that match a set of specific file paths and filenames associated with post-exploitation activity following the SlashAndGrab vulnerability against ScreenConnect. Attackers may drop executables, MSI packages, and other components into predictable directories to stage payloads and establish persistence. It relies on telemetry that reports file events with a populated TargetFilename field, allowing matching on the enumerated path indicators.
Reporting behind it
- huntress.comhttps://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/SlashAndGrab-Exploitation-In-Wild/file_event_win_apt_unknown_exploitation_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows File Events Indicative of SlashAndGrab ScreenConnect Post-Exploitation
id: a67347b6-c0a9-472f-845a-4c153633ab9d
status: test
description: This rule flags Windows file creation or access events that match a set of specific file paths and filenames associated with post-exploitation activity following the SlashAndGrab vulnerability against ScreenConnect. Attackers may drop executables, MSI packages, and other components into predictable directories to stage payloads and establish persistence. It relies on telemetry that reports file events with a populated TargetFilename field, allowing matching on the enumerated path indicators.
references:
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/SlashAndGrab-Exploitation-In-Wild/file_event_win_apt_unknown_exploitation_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
tags:
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
- TargetFilename|contains|all:
- C:\Windows\Temp\ScreenConnect\
- \LB3.exe
- TargetFilename|contains:
- C:\mpyutd.msi
- C:\perflogs\RunSchedulerTaskOnce.ps1
- C:\ProgramData\1.msi
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mpyutd.msi
- C:\ProgramData\update.dat
- C:\Users\oldadmin\Documents\MilsoftConnect\Files\ta.exe
- C:\Windows\Help\Help\SentinelAgentCore.dll
- C:\Windows\Help\Help\SentinelUI.exe
- C:\Windows\spsrv.exe
- C:\Windows\Temp\svchost.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 05164d17-8e11-4d7d-973e-9e4962436b87
type: derived