Windows: ScreenConnect Client Service Spawning Suspicious Utility Commands
Alerts when ScreenConnect run.cmd leads to child processes like cmd.exe, PowerShell, curl, or other utilities.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale (SigmaHQ), DRL 1.1
- Published
- 2022-02-25
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creations where the parent command line contains the ScreenConnect temp directory and invokes run.cmd, and the child process image matches a set of common command-line and utility executables. Attackers can use ScreenConnect to run remote commands and then launch these utilities to execute scripts, retrieve content, or perform local discovery and execution. The detection relies on process creation telemetry capturing the parent command line and the child process image path.
Reporting behind it
- mandiant.comhttps://www.mandiant.com/resources/telegram-malware-iranian-espionage
- docs.connectwise.comhttps://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
- huntress.comhttps://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- trendmicro.comhttps://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: ScreenConnect Client Service Spawning Suspicious Utility Commands"
id: 33b50022-c699-4ef5-991a-ad797feba4de
related:
- id: d1a401ab-8c47-4e86-a7d8-2460b6a53e4a
type: derived
- id: 7b582f1a-b318-4c6a-bf4e-66fe49bf55a5
type: derived
status: test
description: This rule flags Windows process creations where the parent command line contains the ScreenConnect temp directory and invokes run.cmd, and the child process image matches a set of common command-line and utility executables. Attackers can use ScreenConnect to run remote commands and then launch these utilities to execute scripts, retrieve content, or perform local discovery and execution. The detection relies on process creation telemetry capturing the parent command line and the child process image path.
references:
- https://www.mandiant.com/resources/telegram-malware-iranian-espionage
- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale, Huntrule Team
date: 2022-02-25
modified: 2024-02-28
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: process_creation
detection:
selection:
ParentCommandLine|contains|all:
- :\Windows\TEMP\ScreenConnect\
- run.cmd
Image|endswith:
- \bitsadmin.exe
- \cmd.exe
- \curl.exe
- \dllhost.exe
- \net.exe
- \nltest.exe
- \powershell.exe
- \pwsh.exe
- \rundll32.exe
- \wevtutil.exe
condition: selection
falsepositives:
- If the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed.
level: medium
license: DRL-1.1