Active ScreenConnect Attacks Breach MSPs: Detection, Hunting, and Remediation Guide

---
title: ScreenConnect Rogue Client Installation via Suspicious Process
description: Detects potential unauthorized ScreenConnect client installations or executions from non-standard directories, which may indicate rogue client deployment following MSP compromise.
author: Security Arsenal
date: 2026/01/15
references:
  - https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\ScreenConnect.ClientService.exe'
    - Image|endswith: '\ScreenConnect.WindowsClient.exe'
  filter_legitimate:
    Image|startswith:
      - 'C:\Program Files\ScreenConnect'
      - 'C:\Program Files (x86)\ScreenConnect'
  condition: selection_img and not filter_legitimate
falsepositives:
  - Custom installation paths during legitimate deployment
  - Portable installations by authorized administrators
level: high
---
title: Suspicious Remote Access Tool Execution Following ScreenConnect Activity
description: Identifies execution of additional remote access tools (RATs) shortly after ScreenConnect client activity, potentially indicating rogue client deployment by threat actors.
author: Security Arsenal
date: 2026/01/15
references:
  - https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/
logsource:
  category: process_creation
  product: windows
detection:
  selection_primary:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
  selection_rat:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\splashtop.exe'
      - '\logmein.exe'
      - '\vncserver.exe'
      - '\rustdesk.exe'
  timeframe: 15m
  condition: selection_primary and selection_rat
falsepositives:
  - Legitimate use of multiple remote access tools by administrators
  - Migration between remote access platforms
level: medium
---
title: ScreenConnect Service Modification or Creation
description: Detects creation or modification of Windows services related to ScreenConnect, which may indicate persistence mechanism establishment by attackers.
author: Security Arsenal
date: 2026/01/15
references:
  - https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - 'create'
      - 'ScreenConnect'
  selection_ps:
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:
      - 'New-Service'
      - 'ScreenConnect'
  condition: selection_sc or selection_ps
falsepositives:
  - Legitimate ScreenConnect installation or updates
  - MSP deployment scripts
level: high

// Hunt for ScreenConnect processes executing from non-standard directories
// This may indicate rogue client deployment
let TimeWindow = 7d;
DeviceProcessEvents
| where TimeGenerated > ago(TimeWindow)
| where FileName has_any ("ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe")
| where not(FolderPath has_any ("C:\\Program Files\\ScreenConnect", "C:\\Program Files (x86)\\ScreenConnect"))
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc;

// Hunt for suspicious remote access tool installations following ScreenConnect activity
let ScreenConnectActivity = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName has_any ("ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe")
    | summarize by DeviceName, bin(TimeGenerated, 15m);
let RATExecution = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName has_any ("AnyDesk.exe", "TeamViewer.exe", "splashtop.exe", "logmein.exe", "rustdesk.exe")
    | summarize by DeviceName, bin(TimeGenerated, 15m);
ScreenConnectActivity
| join kind=inner RATExecution on DeviceName, TimeGenerated
| project TimeGenerated, DeviceName
| order by TimeGenerated desc;

// Hunt for network connections to known ScreenConnect relay servers from unexpected sources
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("screenconnect.com", "connectwise.com") or RemoteIP in ("<known_screenconnect_ips>")
| where not(InitiatingProcessFileName has_any ("ScreenConnect"))
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt for service creation events related to ScreenConnect
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 7045
| where ServiceName has "ScreenConnect"
| where not(ServiceFileName has_any ("C:\\Program Files\\ScreenConnect", "C:\\Program Files (x86)\\ScreenConnect"))
| project TimeGenerated, Computer, ServiceName, ServiceFileName, ServiceType, ServiceStartType, ServiceAccount
| order by TimeGenerated desc;

-- Hunt for ScreenConnect client artifacts and potential rogue installations
-- This artifact examines process execution, file system artifacts, and service installations

// Check for ScreenConnect processes running from non-standard locations
SELECT 
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE 
    (Name =~ 'ScreenConnect' OR Exe =~ 'ScreenConnect')
    AND NOT Exe =~ 'C:\\Program Files\\ScreenConnect'
    AND NOT Exe =~ 'C:\\Program Files \(x86\)\\ScreenConnect'

// Check for ScreenConnect files in suspicious locations
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime
FROM glob(globs='C:\\Users\\*\\AppData\\**\\ScreenConnect*')
WHERE NOT FullPath =~ 'C:\\Users\\*\\AppData\\Local\\ScreenConnect'

// Check for services with ScreenConnect in the name but non-standard paths
SELECT 
    Name,
    DisplayName,
    PathName,
    StartName,
    StartType
FROM services()
WHERE 
    Name =~ 'ScreenConnect' OR DisplayName =~ 'ScreenConnect'
    AND NOT PathName =~ 'C:\\Program Files\\ScreenConnect'

// Check for persistence mechanisms in Run keys
SELECT 
    Key,
    Name,
    Value
FROM read_reg_key(globs='HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*')
WHERE Value =~ 'ScreenConnect'
    AND NOT Value =~ 'C:\\Program Files\\ScreenConnect'

# ScreenConnect Compromise Assessment and Remediation Script
# Run with administrative privileges on all managed endpoints

Write-Host "=== ScreenConnect Compromise Assessment ===" -ForegroundColor Cyan
Write-Host "Assessment Time: $(Get-Date)" -ForegroundColor Cyan

# 1. Identify all ScreenConnect installations and their paths
Write-Host "`n[1] Identifying ScreenConnect installations..." -ForegroundColor Yellow
$screenConnectPaths = @()
$screenConnectPaths += Get-ChildItem -Path "C:\Program Files", "C:\Program Files (x86)" -Filter "ScreenConnect*" -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
$screenConnectPaths += Get-ChildItem -Path "C:\Users" -Filter "ScreenConnect*" -Directory -Recurse -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName

if ($screenConnectPaths.Count -eq 0) {
    Write-Host "No ScreenConnect installations found." -ForegroundColor Green
} else {
    Write-Host "Found ScreenConnect at: $($screenConnectPaths -join ', ')" -ForegroundColor $(if ($screenConnectPaths -match "Program Files") { "Yellow" } else { "Red" })
}

# 2. Check running ScreenConnect processes
Write-Host "`n[2] Checking running ScreenConnect processes..." -ForegroundColor Yellow
$scProcesses = Get-Process | Where-Object { $_.Name -like "*ScreenConnect*" }
if ($scProcesses) {
    $scProcesses | ForEach-Object {
        $path = $_.Path
        $status = if ($path -like "*Program Files*") { "LIKELY LEGITIMATE" } else { "SUSPICIOUS - Non-standard path" }
        Write-Host "  PID: $($_.Id) | Path: $path | Status: $status" -ForegroundColor $(if ($status -eq "SUSPICIOUS - Non-standard path") { "Red" } else { "Green" })
    }
} else {
    Write-Host "No ScreenConnect processes currently running." -ForegroundColor Green
}

# 3. Check ScreenConnect services
Write-Host "`n[3] Checking ScreenConnect services..." -ForegroundColor Yellow
$scServices = Get-WmiObject -Class Win32_Service | Where-Object { $_.Name -like "*ScreenConnect*" -or $_.DisplayName -like "*ScreenConnect*" }
if ($scServices) {
    $scServices | ForEach-Object {
        $path = $_.PathName
        $status = if ($path -like "*Program Files*") { "LIKELY LEGITIMATE" } else { "SUSPICIOUS - Non-standard path" }
        Write-Host "  Service: $($_.Name) | Path: $path | Status: $status" -ForegroundColor $(if ($status -eq "SUSPICIOUS - Non-standard path") { "Red" } else { "Green" })
    }
} else {
    Write-Host "No ScreenConnect services found." -ForegroundColor Green
}

# 4. Check for additional remote access tools
Write-Host "`n[4] Checking for additional remote access tools..." -ForegroundColor Yellow
$ratTools = @("AnyDesk", "TeamViewer", "Splashtop", "LogMeIn", "RustDesk", "VNC", "Chrome Remote Desktop")
$foundRATs = @()
foreach ($tool in $ratTools) {
    $processes = Get-Process | Where-Object { $_.Name -like "*$tool*" }
    if ($processes) {
        $foundRATs += $tool
        Write-Host "  FOUND: $tool running" -ForegroundColor Red
    }
}
if ($foundRATs.Count -eq 0) {
    Write-Host "No additional remote access tools detected." -ForegroundColor Green
}

# 5. Check network connections
Write-Host "`n[5] Checking active network connections for ScreenConnect..." -ForegroundColor Yellow
$scConnections = Get-NetTCPConnection | Where-Object { $_.OwningProcess -in ($scProcesses | Select-Object -ExpandProperty Id) }
if ($scConnections) {
    $scConnections | ForEach-Object {
        $process = Get-Process -Id $_.OwningProcess
        Write-Host "  $($process.Name) -> $($_.RemoteAddress):$($_.RemotePort) (State: $($_.State))" -ForegroundColor Yellow
    }
} else {
    Write-Host "No active ScreenConnect network connections." -ForegroundColor Green
}

# 6. Check recent file modifications in ScreenConnect directories
Write-Host "`n[6] Checking for recently modified ScreenConnect files..." -ForegroundColor Yellow
$recentFiles = @()
foreach ($path in $screenConnectPaths) {
    if (Test-Path $path) {
        $recentFiles += Get-ChildItem -Path $path -Recurse -File | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | Select-Object -First 10
    }
}
if ($recentFiles) {
    Write-Host "Recently modified files (last 7 days):" -ForegroundColor Yellow
    $recentFiles | ForEach-Object { Write-Host "  $($_.FullName) - Modified: $($_.LastWriteTime)" }
} else {
    Write-Host "No recent modifications detected." -ForegroundColor Green
}

# 7. Recommendations
Write-Host "`n=== RECOMMENDATIONS ===" -ForegroundColor Cyan
Write-Host "1. If SUSPICIOUS paths detected: Isolate the endpoint from the network immediately" -ForegroundColor White
Write-Host "2. Reset all credentials used by the MSP for remote access" -ForegroundColor White
Write-Host "3. Review ScreenConnect session logs for unauthorized access" -ForegroundColor White
Write-Host "4. Consider complete reinstallation of ScreenConnect from known-good media" -ForegroundColor White
Write-Host "5. Implement network segmentation to limit lateral movement" -ForegroundColor White
Write-Host "6. Enable MFA on all ScreenConnect administrative accounts" -ForegroundColor White
Write-Host "7. Contact your MSP and ConnectWise for incident response support" -ForegroundColor White

# Optional: Export findings to CSV
$exportData = @{
    Timestamp = Get-Date
    ScreenConnectPaths = $screenConnectPaths -join "; "
    RunningProcesses = ($scProcesses | ForEach-Object { "$($_.Id):$($_.Path)" }) -join "; "
    Services = ($scServices | ForEach-Object { "$($_.Name):$($_.PathName)" }) -join "; "
    AdditionalRATs = $foundRATs -join "; "
}
$exportData | Export-Csv -Path "ScreenConnect_Assessment_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
Write-Host "`nAssessment exported to CSV file." -ForegroundColor Green