Windows ScreenConnect Remote Command Execution via Application Event 200

Detects ScreenConnect command execution on Windows by matching EventID 200 with an 'Executed command of length' message.

FreeUnreviewedSigmalowv1

windows-screenconnect-remote-command-execution-via-application-event-200-076ebe48

title: Windows ScreenConnect Remote Command Execution via Application Event 200
id: e8cd7db6-6124-4014-b6e1-34a32e379c89
related:
  - id: b1f73849-6329-4069-bc8f-78a604bb8b23
    type: similar
  - id: 076ebe48-cc05-4d8f-9d41-89245cd93a14
    type: derived
status: test
description: This rule flags application logs indicating ScreenConnect executed a command, matching an event with Provider_Name set to ScreenConnect and EventID 200 where the payload contains 'Executed command of length'. Command execution through remote administration tooling can enable attackers to run arbitrary actions under legitimate software, so timely detection matters. It relies on Windows application telemetry that records ScreenConnect command execution details.
references:
  - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling
  - https://github.com/SigmaHQ/sigma/pull/4467
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_command_exec.yml
author: Ali Alwashali, Huntrule Team
date: 2023-10-10
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  service: application
  product: windows
detection:
  selection:
    Provider_Name: ScreenConnect
    EventID: 200
    Data|contains: Executed command of length
  condition: selection
falsepositives:
  - Legitimate use of ScreenConnect
level: low
license: DRL-1.1

What it detects

This rule flags application logs indicating ScreenConnect executed a command, matching an event with Provider_Name set to ScreenConnect and EventID 200 where the payload contains 'Executed command of length'. Command execution through remote administration tooling can enable attackers to run arbitrary actions under legitimate software, so timely detection matters. It relies on Windows application telemetry that records ScreenConnect command execution details.

Known false positives

Legitimate use of ScreenConnect

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.