Threat video1:00
ScreenConnect MSP Run Command Abuse: Detection & IOCs
Attackers push rogue ScreenConnect clients through MSP Run Command abuse. Includes 9 detection rules (one free in Splunk SPL) and 18 IOCs.
Read the full threat intel for ScreenConnect MSP Run Command Abuse: Detection & IOCs →
Chapters
- 0:00The hook286+ endpoints affected by rogue ScreenConnect.
- 0:05The storyAttackers abused ScreenConnect Run Command.
- 0:11Attack pathInitial access is undetermined; telemetry points to compromised credentials.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise15 indicators to hunt: 2 IPs, 7 domains and 1 SHA-256 hash, and more.
- 0:38MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation5 steps now: Review ScreenConnect Run Command history for unexpected deployments, including older.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00286+ endpoints affected by rogue ScreenConnect.
0:05Attackers abused ScreenConnect Run Command.
0:08Rogue clients reached customer endpoints.
0:11Initial access is undetermined; telemetry points to compromised credentials.
0:17Attackers used Run Command to push rogue clients.
0:20Observed infrastructure includes relays and C2 domains.
0:26No threat actor is attributed. Confidence: low.
0:3015 indicators to hunt: 2 IPs, 7 domains and 1 SHA-256 hash, and more.
0:387 ATT&CK techniques, from initial access to command and control.
0:435 steps now: Review ScreenConnect Run Command history for unexpected deployments, including older.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.