Windows Process Execution from ScreenConnect.ClientService.exe
Alerts on Windows process creation spawned by ScreenConnect.ClientService.exe, indicating potential remote command execution.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-02-23
- Updated
- 2026-07-31
What it detects
This rule flags process creation events on Windows where the parent process is ScreenConnect.ClientService.exe. Attackers using ScreenConnect for remote access can spawn arbitrary binaries or commands through this service, making this behavior a useful indicator for hunting. The rule relies on process creation telemetry, specifically the ParentImage ending with \ScreenConnect.ClientService.exe.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-screenconnect-remote-command-execution-via-clientservice-exe-process-cre-d1a401ab
title: Windows Process Execution from ScreenConnect.ClientService.exe
id: e413da5a-4c17-4bc2-b376-071ed340bdfa
related:
- id: b1f73849-6329-4069-bc8f-78a604bb8b23
type: derived
- id: 7b582f1a-b318-4c6a-bf4e-66fe49bf55a5
type: derived
- id: d1a401ab-8c47-4e86-a7d8-2460b6a53e4a
type: derived
status: test
description: This rule flags process creation events on Windows where the parent process is ScreenConnect.ClientService.exe. Attackers using ScreenConnect for remote access can spawn arbitrary binaries or commands through this service, making this behavior a useful indicator for hunting. The rule relies on process creation telemetry, specifically the ParentImage ending with \ScreenConnect.ClientService.exe.
references:
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_child_proc.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
modified: 2024-02-26
tags:
- attack.execution
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \ScreenConnect.ClientService.exe
condition: selection
falsepositives:
- Legitimate commands launched from ScreenConnect will also trigger this rule. Look for anomalies.
level: medium
license: DRL-1.1