Windows: ScreenConnect Client Service Spawning Suspicious Utility Commands

Alerts when ScreenConnect run.cmd leads to child processes like cmd.exe, PowerShell, curl, or other utilities.

FreeUnreviewedSigmamediumv1

windows-screenconnect-client-service-spawning-suspicious-utility-commands-7b582f1a

title: "Windows: ScreenConnect Client Service Spawning Suspicious Utility Commands"
id: 33b50022-c699-4ef5-991a-ad797feba4de
related:
  - id: d1a401ab-8c47-4e86-a7d8-2460b6a53e4a
    type: derived
  - id: 7b582f1a-b318-4c6a-bf4e-66fe49bf55a5
    type: derived
status: test
description: This rule flags Windows process creations where the parent command line contains the ScreenConnect temp directory and invokes run.cmd, and the child process image matches a set of common command-line and utility executables. Attackers can use ScreenConnect to run remote commands and then launch these utilities to execute scripts, retrieve content, or perform local discovery and execution. The detection relies on process creation telemetry capturing the parent command line and the child process image path.
references:
  - https://www.mandiant.com/resources/telegram-malware-iranian-espionage
  - https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  - https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale, Huntrule Team
date: 2022-02-25
modified: 2024-02-28
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentCommandLine|contains|all:
      - :\Windows\TEMP\ScreenConnect\
      - run.cmd
    Image|endswith:
      - \bitsadmin.exe
      - \cmd.exe
      - \curl.exe
      - \dllhost.exe
      - \net.exe
      - \nltest.exe
      - \powershell.exe
      - \pwsh.exe
      - \rundll32.exe
      - \wevtutil.exe
  condition: selection
falsepositives:
  - If the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed.
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creations where the parent command line contains the ScreenConnect temp directory and invokes run.cmd, and the child process image matches a set of common command-line and utility executables. Attackers can use ScreenConnect to run remote commands and then launch these utilities to execute scripts, retrieve content, or perform local discovery and execution. The detection relies on process creation telemetry capturing the parent command line and the child process image path.

Known false positives

If the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.