Windows: ScreenConnect local user database XML modified
Flags Windows file modifications by ScreenConnect.Service.exe to a Temp/ScreenConnect XML user database file.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- file_event
- Author
- Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress (SigmaHQ), DRL 1.1
- Published
- 2024-02-21
- Updated
- 2026-07-31
What it detects
This rule identifies modifications to the temporary ScreenConnect XML user database file by watching for .xml changes under Temp/ScreenConnect when executed by ScreenConnect.Service.exe. User database changes are a key persistence and access-control objective, so tampering with these files may indicate unauthorized local user or permission modifications. It relies on Windows file event telemetry that includes the modified filename and the initiating process image path.
Reporting behind it
- connectwise.comhttps://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- cve.orghttps://www.cve.org/CVERecord?id=CVE-2024-1709
- huntress.comhttps://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/file_event_win_exploit_cve_2024_1709_user_database_modification_screenconnect.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-modification-of-screenconnect-temporary-xml-user-database-1a821580
title: "Windows: ScreenConnect local user database XML modified"
id: d1cec672-a6c3-440d-acb5-8e008db1b1d6
related:
- id: 4109cb6a-a4af-438a-9f0c-056abba41c6f
type: similar
- id: 1a821580-588b-4323-9422-660f7e131020
type: derived
status: test
description: This rule identifies modifications to the temporary ScreenConnect XML user database file by watching for .xml changes under Temp/ScreenConnect when executed by ScreenConnect.Service.exe. User database changes are a key persistence and access-control objective, so tampering with these files may indicate unauthorized local user or permission modifications. It relies on Windows file event telemetry that includes the modified filename and the initiating process image path.
references:
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.cve.org/CVERecord?id=CVE-2024-1709
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/file_event_win_exploit_cve_2024_1709_user_database_modification_screenconnect.yml
author: Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress, Huntrule Team
date: 2024-02-21
tags:
- attack.persistence
- cve.2024-1709
- detection.emerging-threats
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: .xml
TargetFilename|contains|all:
- Temp
- ScreenConnect
Image|endswith: \ScreenConnect.Service.exe
condition: selection
falsepositives:
- This will occur legitimately as well and will result in some benign activity.
level: medium
license: DRL-1.1