Windows: ScreenConnect service modifies temporary XML user database files

Alerts when ScreenConnect.Service.exe performs write access to temporary ScreenConnect XML user database files on Windows.

FreeUnreviewedSigmamediumv1

windows-screenconnect-service-modifies-temporary-xml-user-database-files-4109cb6a

title: "Windows: ScreenConnect service modifies temporary XML user database files"
id: 067e057a-53dc-4ee0-a573-2e455eb6b413
related:
  - id: 1a821580-588b-4323-9422-660f7e131020
    type: similar
  - id: 4109cb6a-a4af-438a-9f0c-056abba41c6f
    type: derived
status: test
description: This rule flags Windows Security Event ID 4663 file-access activity where ScreenConnect.Service.exe modifies a temporary XML file matching “Temp” and “ScreenConnect” in its name. Attackers may use this to alter local user or permission data during authentication bypass or other unauthorized changes. Detection relies on advanced auditing (SACL on the ScreenConnect directory) to capture successful 4663 events, specifically file writes (AccessMask 0x6) on XML files.
references:
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://www.cve.org/CVERecord?id=CVE-2024-1709
  - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/win_security_exploit_cve_2024_1709_user_database_modification_screenconnect.yml
author: Matt Anderson, Kris Luzadre, Andrew Schwartz, Huntress, Huntrule Team
date: 2024-02-20
tags:
  - cve.2024-1709
  - detection.emerging-threats
  - attack.defense-impairment
logsource:
  product: windows
  service: security
  definition: "Requirements: SACLs must be enabled for the ScreenConnect directory"
detection:
  selection:
    EventID: 4663
    ObjectType: File
    AccessMask: "0x6"
    ObjectName|endswith: .xml
    ObjectName|contains|all:
      - Temp
      - ScreenConnect
    ProcessName|contains: ScreenConnect.Service.exe
  condition: selection
falsepositives:
  - This will occur legitimately as well and will result in some benign activity.
level: medium
license: DRL-1.1

What it detects

This rule flags Windows Security Event ID 4663 file-access activity where ScreenConnect.Service.exe modifies a temporary XML file matching “Temp” and “ScreenConnect” in its name. Attackers may use this to alter local user or permission data during authentication bypass or other unauthorized changes. Detection relies on advanced auditing (SACL on the ScreenConnect directory) to capture successful 4663 events, specifically file writes (AccessMask 0x6) on XML files.

Known false positives

This will occur legitimately as well and will result in some benign activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.