Windows Process Creation: ScreenConnect Service Execution

Alerts on Windows executions identified as ScreenConnect service/product/company strings, indicating potential remote access C2 activity.

FreeUnreviewedSigmamediumv1

windows-process-creation-screenconnect-service-execution-57bff678

title: "Windows Process Creation: ScreenConnect Service Execution"
id: f6f67611-b533-4292-a725-31d9926ad08f
status: test
description: This rule matches Windows process creation events where the process metadata indicates ScreenConnect, including a ScreenConnect service and related product/company strings. Attackers may use remote access tools like ScreenConnect to establish interactive connectivity for command and control while blending in with legitimate software. Telemetry relied on is process creation data on Windows, specifically fields containing Description, Product, and Company identifying ScreenConnect.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect.yml
author: frack113, Huntrule Team
date: 2022-02-13
modified: 2023-03-05
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: ScreenConnect Service
    - Product: ScreenConnect
    - Company: ScreenConnect Software
  condition: selection
falsepositives:
  - Legitimate usage of the tool
level: medium
license: DRL-1.1
related:
  - id: 57bff678-25d1-4d6c-8211-8ca106d12053
    type: derived

What it detects

This rule matches Windows process creation events where the process metadata indicates ScreenConnect, including a ScreenConnect service and related product/company strings. Attackers may use remote access tools like ScreenConnect to establish interactive connectivity for command and control while blending in with legitimate software. Telemetry relied on is process creation data on Windows, specifically fields containing Description, Product, and Company identifying ScreenConnect.

Known false positives

Legitimate usage of the tool

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.