huntrule

Windows ScreenConnect Installation Execution via Remote Access Parameters

Flags Windows executions of ScreenConnect with remote access command-line parameters indicating remote session setup.

FreeUnreviewedSigmamediumv1
title: Windows ScreenConnect Installation Execution via Remote Access Parameters
id: c01ebc59-ba5e-4aec-b834-2bc25e4d73c4
status: test
description: This rule matches Windows process creation events where the command line contains ScreenConnect-specific remote access parameters (e=Access, y=Guest, and p=, c=, k=). Attackers commonly use remote access tooling to establish interactive control and persistence after initial access. The detection relies on process creation telemetry, specifically the full command-line string in process start events.
references:
  - https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-02-11
modified: 2024-02-26
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - e=Access&
      - y=Guest&
      - "&p="
      - "&c="
      - "&k="
  condition: selection
falsepositives:
  - Legitimate use by administrative staff
level: medium
license: DRL-1.1
related:
  - id: 75bfe6e6-cd8e-429e-91d3-03921e1d7962
    type: derived

What it detects

This rule matches Windows process creation events where the command line contains ScreenConnect-specific remote access parameters (e=Access, y=Guest, and p=, c=, k=). Attackers commonly use remote access tooling to establish interactive control and persistence after initial access. The detection relies on process creation telemetry, specifically the full command-line string in process start events.

Known false positives

  • Legitimate use by administrative staff

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.