Windows ScreenConnect Service Web Shell Execution via cmd.exe or csc.exe

Alert on ScreenConnect.Service.exe spawning cmd.exe or csc.exe, consistent with potential web shell execution on Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Jason Rathbun (Blackpoint Cyber) (SigmaHQ), DRL 1.1
Published: 2024-02-26
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags web shell execution attempts by detecting ScreenConnect service process activity that spawns Windows command interpreter or script/compiler utilities. Such behavior is significant because attackers may use command execution pathways on the server to establish or run malicious web shells. It relies on Windows process creation telemetry, matching the parent ScreenConnect service executable and child process image paths for cmd.exe and csc.exe.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Possible Apache ActiveMQ Exploitation via Java Spawning Command Shell (via process_creation)

Malicious Veeam CVE-2023-27532 Exploitation Enabling xp_cmdshell via VeeamHax (via process_creation)

Suspicious PraisonAI Unauthenticated Config Endpoint Access via Webserver

Malicious Langflow Build Public Temp RCE Access via Webserver

Suspicious PraisonAI Vulnerability Scanner User Agent via Webserver

Malicious LiteLLM Authentication SQL Injection via Web Request (via webserver)

Possible Marimo Unauthenticated Terminal WebSocket Access via Web Request (via webserver)

Possible React2Shell Next.js Prototype Pollution Exploitation via Web Request (via webserver)

Malicious Marimo Notebook Credential File Access via Shell (via process_creation)

Windows ScreenConnect Service Web Shell Execution via cmd.exe or csc.exe

Pivot detection · T1190 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-screenconnect-service-web-shell-execution-via-cmd-exe-or-csc-exe-b19146a3

title: Windows ScreenConnect Service Web Shell Execution via cmd.exe or csc.exe
id: 77f099c8-8733-4d1f-8ca0-fa3b30864b57
status: test
description: This rule flags web shell execution attempts by detecting ScreenConnect service process activity that spawns Windows command interpreter or script/compiler utilities. Such behavior is significant because attackers may use command execution pathways on the server to establish or run malicious web shells. It relies on Windows process creation telemetry, matching the parent ScreenConnect service executable and child process image paths for cmd.exe and csc.exe.
references:
  - https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_webshell.yml
author: Jason Rathbun (Blackpoint Cyber), Huntrule Team
date: 2024-02-26
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \ScreenConnect.Service.exe
    Image|endswith:
      - \cmd.exe
      - \csc.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: b19146a3-25d4-41b4-928b-1e2a92641b1b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL