Windows File Modification of ScreenConnect Temporary XML User Database

Flags Windows file modifications by ScreenConnect.Service.exe to a Temp/ScreenConnect XML user database file.

FreeUnreviewedSigmamediumv1

windows-file-modification-of-screenconnect-temporary-xml-user-database-1a821580

title: Windows File Modification of ScreenConnect Temporary XML User Database
id: d1cec672-a6c3-440d-acb5-8e008db1b1d6
related:
  - id: 4109cb6a-a4af-438a-9f0c-056abba41c6f
    type: similar
  - id: 1a821580-588b-4323-9422-660f7e131020
    type: derived
status: test
description: This rule alerts on file events where ScreenConnect.Service.exe modifies a temporary XML file whose path contains both “Temp” and “ScreenConnect”. Changes to this local user database are significant because they can indicate local user or permission tampering, including activity consistent with authentication-bypass exploitation. The detection relies on Windows file telemetry capturing the modified target filename and the initiating executable path ending with “\ScreenConnect.Service.exe”.
references:
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://www.cve.org/CVERecord?id=CVE-2024-1709
  - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/file_event_win_exploit_cve_2024_1709_user_database_modification_screenconnect.yml
author: Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress, Huntrule Team
date: 2024-02-21
tags:
  - attack.persistence
  - cve.2024-1709
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: .xml
    TargetFilename|contains|all:
      - Temp
      - ScreenConnect
    Image|endswith: \ScreenConnect.Service.exe
  condition: selection
falsepositives:
  - This will occur legitimately as well and will result in some benign activity.
level: medium
license: DRL-1.1

What it detects

This rule alerts on file events where ScreenConnect.Service.exe modifies a temporary XML file whose path contains both “Temp” and “ScreenConnect”. Changes to this local user database are significant because they can indicate local user or permission tampering, including activity consistent with authentication-bypass exploitation. The detection relies on Windows file telemetry capturing the modified target filename and the initiating executable path ending with “\ScreenConnect.Service.exe”.

Known false positives

This will occur legitimately as well and will result in some benign activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.