Remote Access Tool - ScreenConnect Remote Command Execution

Status: test
Severity: low
Log source: category process_creation, product windows
Author: Ali Alwashali
Source: github.com/SigmaHQ/sigma

Detects the execution of a system command via the ScreenConnect RMM service.

Known false positives

Legitimate use of ScreenConnect. Disable this rule if ScreenConnect is heavily used.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.003` Command and Scripting Interpreter: Windows Command Shell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Remote Access Tool - ScreenConnect Remote Command Execution
id: b1f73849-6329-4069-bc8f-78a604bb8b23
status: test
description: Detects the execution of a system command via the ScreenConnect RMM service.
references:
    - https://github.com/SigmaHQ/sigma/pull/4467
author: Ali Alwashali
date: 2023-10-10
modified: 2024-02-26
tags:
    - attack.execution
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\ScreenConnect.ClientService.exe'
    selection_img:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_cli:
        # Example:
        #   CommandLine: "cmd.exe" /c "C:\Windows\TEMP\ScreenConnect\23.6.8.8644\3c41d689-bbf5-4216-b2f4-ba8fd6192c25run.cmd"
        CommandLine|contains: '\TEMP\ScreenConnect\'
    condition: all of selection_*
falsepositives:
    - Legitimate use of ScreenConnect. Disable this rule if ScreenConnect is heavily used.
# Note: Increase the level if you don't leverage ScreenConnect
level: low

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|endswith: '\ScreenConnect.ClientService.exe'

Stage 2: `selection_img`

selection_img:
    - Image|endswith: '\cmd.exe'
    - OriginalFileName: 'Cmd.Exe'

Stage 3: `selection_cli`

selection_cli:
    CommandLine|contains: '\TEMP\ScreenConnect\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`\TEMP\ScreenConnect\`	`field:"CommandLine" kind:match value:"\TEMP\ScreenConnect\"`
`Image`	ends_with	`\cmd.exe` corpus 130 (sigma 130)	`field:"Image" kind:ends_with value:"\cmd.exe"`
`OriginalFileName`	eq	`Cmd.Exe` corpus 81 (sigma 43, elastic 21, splunk 17)	`field:"OriginalFileName" kind:eq value:"Cmd.Exe"`
`ParentImage`	ends_with	`\ScreenConnect.ClientService.exe` corpus 2 (sigma 2)	`field:"ParentImage" kind:ends_with value:"\ScreenConnect.ClientService.exe"`

Remote Access Tool - ScreenConnect Remote Command Execution

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_parent

Stage 2: selection_img

Stage 3: selection_cli

Indicators

Stage 0: `condition`

Stage 1: `selection_parent`

Stage 2: `selection_img`

Stage 3: `selection_cli`