huntrule

Windows ScreenConnect Service Web Shell Execution via cmd.exe or csc.exe

Alert on ScreenConnect.Service.exe spawning cmd.exe or csc.exe, consistent with potential web shell execution on Windows.

FreeUnreviewedSigmahighv1
title: Windows ScreenConnect Service Web Shell Execution via cmd.exe or csc.exe
id: 77f099c8-8733-4d1f-8ca0-fa3b30864b57
status: test
description: This rule flags web shell execution attempts by detecting ScreenConnect service process activity that spawns Windows command interpreter or script/compiler utilities. Such behavior is significant because attackers may use command execution pathways on the server to establish or run malicious web shells. It relies on Windows process creation telemetry, matching the parent ScreenConnect service executable and child process image paths for cmd.exe and csc.exe.
references:
  - https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_webshell.yml
author: Jason Rathbun (Blackpoint Cyber), Huntrule Team
date: 2024-02-26
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \ScreenConnect.Service.exe
    Image|endswith:
      - \cmd.exe
      - \csc.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: b19146a3-25d4-41b4-928b-1e2a92641b1b
    type: derived

What it detects

This rule flags web shell execution attempts by detecting ScreenConnect service process activity that spawns Windows command interpreter or script/compiler utilities. Such behavior is significant because attackers may use command execution pathways on the server to establish or run malicious web shells. It relies on Windows process creation telemetry, matching the parent ScreenConnect service executable and child process image paths for cmd.exe and csc.exe.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.