ScreenConnect User Database Modification

Status: test
Severity: medium
Log source: category file_event, product windows
Author: Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress
Source: github.com/SigmaHQ/sigma

Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.

Known false positives

This will occur legitimately as well and will result in some benign activity.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: ScreenConnect User Database Modification
id: 1a821580-588b-4323-9422-660f7e131020
related:
    - id: 4109cb6a-a4af-438a-9f0c-056abba41c6f
      type: similar
status: test
description: |
    Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server.
    This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.
references:
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
    - https://www.cve.org/CVERecord?id=CVE-2024-1709
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
author: Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress
date: 2024-02-21
tags:
    - attack.persistence
    - cve.2024-1709
    - detection.emerging-threats
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '.xml'
        TargetFilename|contains|all:
            - 'Temp'
            - 'ScreenConnect'
        Image|endswith: '\ScreenConnect.Service.exe'
    condition: selection
falsepositives:
    - This will occur legitimately as well and will result in some benign activity.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetFilename|endswith: '.xml'
    TargetFilename|contains|all:
        - 'Temp'
        - 'ScreenConnect'
    Image|endswith: '\ScreenConnect.Service.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\ScreenConnect.Service.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\ScreenConnect.Service.exe"`
`TargetFilename`	ends_with	`.xml` corpus 2 (sigma 2)	`field:"TargetFilename" kind:ends_with value:".xml"`
`TargetFilename`	match	`ScreenConnect` `Temp`	`field:"TargetFilename" kind:match`