ScreenConnect Service temp XML user database file modification (Windows Event 4663)
Alerts when ScreenConnect.Service.exe performs write access to temporary ScreenConnect XML user database files on Windows.
- Product
- windows
- Service
- security
- Author
- Matt Anderson, Kris Luzadre, Andrew Schwartz, Huntress (SigmaHQ), DRL 1.1
- Published
- 2024-02-20
- Updated
- 2026-07-31
What it detects
This rule flags attempts by ScreenConnect.Service.exe to modify a temporary XML user database file by matching Windows Security Event ID 4663 for file access with an ObjectType of File and an AccessMask of 0x6. Attackers may use this to alter local user or permission data during ScreenConnect exploitation, though the same telemetry can also occur during legitimate user or permission changes. The detection relies on detailed file auditing (successful 4663 events) enabled via SACLs on the ScreenConnect directory so file modifications to matching .xml Temp/ScreenConnect files are recorded.
Reporting behind it
- connectwise.comhttps://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- cve.orghttps://www.cve.org/CVERecord?id=CVE-2024-1709
- huntress.comhttps://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/win_security_exploit_cve_2024_1709_user_database_modification_screenconnect.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: ScreenConnect Service temp XML user database file modification (Windows Event 4663)
id: 067e057a-53dc-4ee0-a573-2e455eb6b413
related:
- id: 1a821580-588b-4323-9422-660f7e131020
type: similar
- id: 4109cb6a-a4af-438a-9f0c-056abba41c6f
type: derived
status: test
description: This rule flags attempts by ScreenConnect.Service.exe to modify a temporary XML user database file by matching Windows Security Event ID 4663 for file access with an ObjectType of File and an AccessMask of 0x6. Attackers may use this to alter local user or permission data during ScreenConnect exploitation, though the same telemetry can also occur during legitimate user or permission changes. The detection relies on detailed file auditing (successful 4663 events) enabled via SACLs on the ScreenConnect directory so file modifications to matching .xml Temp/ScreenConnect files are recorded.
references:
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
- https://www.cve.org/CVERecord?id=CVE-2024-1709
- https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1709/win_security_exploit_cve_2024_1709_user_database_modification_screenconnect.yml
author: Matt Anderson, Kris Luzadre, Andrew Schwartz, Huntress, Huntrule Team
date: 2024-02-20
tags:
- cve.2024-1709
- detection.emerging-threats
- attack.defense-impairment
logsource:
product: windows
service: security
definition: "Requirements: SACLs must be enabled for the ScreenConnect directory"
detection:
selection:
EventID: 4663
ObjectType: File
AccessMask: "0x6"
ObjectName|endswith: .xml
ObjectName|contains|all:
- Temp
- ScreenConnect
ProcessName|contains: ScreenConnect.Service.exe
condition: selection
falsepositives:
- This will occur legitimately as well and will result in some benign activity.
level: medium
license: DRL-1.1