Windows Process Creation: ScreenConnect Service Execution
Alerts on Windows executions identified as ScreenConnect service/product/company strings, indicating potential remote access C2 activity.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-13
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches Windows process creation events where the process metadata indicates ScreenConnect, including a ScreenConnect service and related product/company strings. Attackers may use remote access tools like ScreenConnect to establish interactive connectivity for command and control while blending in with legitimate software. Telemetry relied on is process creation data on Windows, specifically fields containing Description, Product, and Company identifying ScreenConnect.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: ScreenConnect Service Execution"
id: f6f67611-b533-4292-a725-31d9926ad08f
status: test
description: This rule matches Windows process creation events where the process metadata indicates ScreenConnect, including a ScreenConnect service and related product/company strings. Attackers may use remote access tools like ScreenConnect to establish interactive connectivity for command and control while blending in with legitimate software. Telemetry relied on is process creation data on Windows, specifically fields containing Description, Product, and Company identifying ScreenConnect.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect.yml
author: frack113, Huntrule Team
date: 2022-02-13
modified: 2023-03-05
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
- Description: ScreenConnect Service
- Product: ScreenConnect
- Company: ScreenConnect Software
condition: selection
falsepositives:
- Legitimate usage of the tool
level: medium
license: DRL-1.1
related:
- id: 57bff678-25d1-4d6c-8211-8ca106d12053
type: derived