Windows ScreenConnect RMM System Command Execution via cmd.exe

Flags cmd.exe launched by ScreenConnect.ClientService.exe with a TEMP\ScreenConnect command-line path.

FreeUnreviewedSigmalowv1

windows-screenconnect-rmm-system-command-execution-via-cmd-exe-b1f73849

title: Windows ScreenConnect RMM System Command Execution via cmd.exe
id: 2b35521c-1d9f-437a-aa02-193467a139e2
status: test
description: This rule detects Windows process creation where ScreenConnect.ClientService.exe launches cmd.exe (or cmd.exe by name) and the command line includes a TEMP folder path containing "ScreenConnect". Attackers may use ScreenConnect to execute arbitrary commands on remote endpoints under the guise of legitimate remote management. The detection relies on process creation telemetry capturing the parent image, the child image/original filename, and the command-line string.
references:
  - https://github.com/SigmaHQ/sigma/pull/4467
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution.yml
author: Ali Alwashali, Huntrule Team
date: 2023-10-10
modified: 2024-02-26
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \ScreenConnect.ClientService.exe
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cli:
    CommandLine|contains: \TEMP\ScreenConnect\
  condition: all of selection_*
falsepositives:
  - Legitimate use of ScreenConnect. Disable this rule if ScreenConnect is heavily used.
level: low
license: DRL-1.1
related:
  - id: b1f73849-6329-4069-bc8f-78a604bb8b23
    type: derived

What it detects

This rule detects Windows process creation where ScreenConnect.ClientService.exe launches cmd.exe (or cmd.exe by name) and the command line includes a TEMP folder path containing "ScreenConnect". Attackers may use ScreenConnect to execute arbitrary commands on remote endpoints under the guise of legitimate remote management. The detection relies on process creation telemetry capturing the parent image, the child image/original filename, and the command-line string.

Known false positives

Legitimate use of ScreenConnect. Disable this rule if ScreenConnect is heavily used.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.