Windows File Events Indicative of SlashAndGrab ScreenConnect Post-Exploitation

title: Windows File Events Indicative of SlashAndGrab ScreenConnect Post-Exploitation
id: a67347b6-c0a9-472f-845a-4c153633ab9d
status: test
description: This rule flags Windows file creation or access events that match a set of specific file paths and filenames associated with post-exploitation activity following the SlashAndGrab vulnerability against ScreenConnect. Attackers may drop executables, MSI packages, and other components into predictable directories to stage payloads and establish persistence. It relies on telemetry that reports file events with a populated TargetFilename field, allowing matching on the enumerated path indicators.
references:
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/SlashAndGrab-Exploitation-In-Wild/file_event_win_apt_unknown_exploitation_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
tags:
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    - TargetFilename|contains|all:
        - C:\Windows\Temp\ScreenConnect\
        - \LB3.exe
    - TargetFilename|contains:
        - C:\mpyutd.msi
        - C:\perflogs\RunSchedulerTaskOnce.ps1
        - C:\ProgramData\1.msi
        - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mpyutd.msi
        - C:\ProgramData\update.dat
        - C:\Users\oldadmin\Documents\MilsoftConnect\Files\ta.exe
        - C:\Windows\Help\Help\SentinelAgentCore.dll
        - C:\Windows\Help\Help\SentinelUI.exe
        - C:\Windows\spsrv.exe
        - C:\Windows\Temp\svchost.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 05164d17-8e11-4d7d-973e-9e4962436b87
    type: derived