Windows ScreenConnect Remote Command Execution via ClientService.exe Process Creation

Alerts on Windows process creation spawned by ScreenConnect.ClientService.exe, indicating potential remote command execution.

FreeUnreviewedSigmamediumv1

windows-screenconnect-remote-command-execution-via-clientservice-exe-process-cre-d1a401ab

title: Windows ScreenConnect Remote Command Execution via ClientService.exe Process Creation
id: e413da5a-4c17-4bc2-b376-071ed340bdfa
related:
  - id: b1f73849-6329-4069-bc8f-78a604bb8b23
    type: derived
  - id: 7b582f1a-b318-4c6a-bf4e-66fe49bf55a5
    type: derived
  - id: d1a401ab-8c47-4e86-a7d8-2460b6a53e4a
    type: derived
status: test
description: This rule flags process creations on Windows where the parent process is ScreenConnect.ClientService.exe, indicating remote binary or command execution initiated through the ScreenConnect service. Attackers abuse remote access tooling to execute payloads on target systems while masquerading as legitimate remote management activity. Detection relies on process creation telemetry, specifically the ParentImage path ending with \ScreenConnect.ClientService.exe.
references:
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_child_proc.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
modified: 2024-02-26
tags:
  - attack.execution
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \ScreenConnect.ClientService.exe
  condition: selection
falsepositives:
  - Legitimate commands launched from ScreenConnect will also trigger this rule. Look for anomalies.
level: medium
license: DRL-1.1

What it detects

This rule flags process creations on Windows where the parent process is ScreenConnect.ClientService.exe, indicating remote binary or command execution initiated through the ScreenConnect service. Attackers abuse remote access tooling to execute payloads on target systems while masquerading as legitimate remote management activity. Detection relies on process creation telemetry, specifically the ParentImage path ending with \ScreenConnect.ClientService.exe.

Known false positives

Legitimate commands launched from ScreenConnect will also trigger this rule. Look for anomalies.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.