Fake Bank of America Phishing Drops Malicious ScreenConnect RMM: Detection, Hunting, and Removal Guide

---
title: ScreenConnect Client Execution From User-Writable or Non-Standard Path
id: 3f9c1a2e-7b44-4d81-9f6a-2c8e5b1d4a90
status: experimental
description: Detects ScreenConnect client binaries executing from user-writable or non-standard directories, consistent with phishing-delivered RMM staging. ScreenConnect is frequently abused by threat actors for unauthorized remote access and persistence.
references:
  - https://www.infosecurity-magazine.com/news/fake-bank-of-america-phishing-scam/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|contains:
      - '\ScreenConnect'
      - '\ConnectWise'
  selection_path:
    Image|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\Temp\'
      - '\Downloads\'
      - '\ProgramData\'
  condition: selection_binary and selection_path
falsepositives:
  - Portable ScreenConnect sessions legitimately launched from Downloads by helpdesk staff; scope to authorized technician accounts
level: high
---
title: Script Interpreter Spawning RMM Installer or Executable Download
id: 8b2d4f71-3c5a-4e9b-a1d7-6f0c9e2b5a31
status: experimental
description: Detects PowerShell, WScript, CScript, or mshta launching an installer or executable consistent with phishing-delivered script staging of remote access tooling such as ScreenConnect.
references:
  - https://www.infosecurity-magazine.com/news/fake-bank-of-america-phishing-scam/
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_child:
    CommandLine|contains:
      - 'ScreenConnect'
      - 'ClientSetup'
      - 'ConnectWise'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate software deployment scripts from RMM or endpoint management platforms; filter to known deployment service accounts and paths
level: high
---
title: Unauthorized ScreenConnect Service Installation
id: c51e7a83-9d26-4f48-b3e1-8a4f2d7c6b15
status: experimental
description: Detects installation of a Windows service whose name follows the ScreenConnect Client (GUID) pattern, indicating RMM persistence being established. Should be correlated against an authorized RMM inventory.
references:
  - https://www.infosecurity-magazine.com/news/fake-bank-of-america-phishing-scam/
  - https://attack.mitre.org/techniques/T1543.003/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1543.003
  - attack.t1219
logsource:
  category: service_creation
  product: windows
detection:
  selection:
    ServiceName|contains:
      - 'ScreenConnect Client'
    ImagePath|contains:
      - '\ScreenConnect'
  condition: selection
falsepositives:
  - Sanctioned ScreenConnect deployment by IT or MSP; maintain an exclusion list of authorized service GUIDs and install hosts
level: critical

// Hunt: Unauthorized ScreenConnect RMM installation and C2 activity
// Scope: 14 days | Tune $authorized_relay and $authorized_path before production use
let lookback = 14d;
let authorized_relays = dynamic(["screenconnect.yourmsp.com", "connect.yourdomain.com"]);
let authorized_path_prefixes = dynamic(["C:\\Program Files (x86)\\ScreenConnect Client (AUTHORIZED-GUID)"]);
union isfuzzy=true
(
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any ("ScreenConnect", "ClientSetup", "ConnectWise")
       or ProcessCommandLine has_any ("ScreenConnect", "ClientSetup", "ConnectWise")
    | project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, Evidence="ProcessExecution"
),
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName has_any ("ScreenConnect", "ConnectWise")
       or RemotePort in (8040, 8041)
    | where not(RemoteUrl has_any (authorized_relays))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP, RemotePort, Evidence="NetworkC2"
),
(
    Event
    | where TimeGenerated > ago(lookback)
    | where EventID == 7045  // Service installed (via Windows Event ingestion)
    | where EventData has "ScreenConnect"
    | project TimeGenerated, Computer, RenderedDescription, Evidence="ServiceInstall"
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(lookback)
    | where FolderPath has_any ("\\AppData\\", "\\Users\\Public\\", "\\Temp\\", "\\Downloads\\")
      and FileName has_any ("ScreenConnect", "ClientSetup")
    | project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, Evidence="FileDrop"
)
| order by TimeGenerated desc

-- Artifact: Hunt.ScreenConnectUnauthorized
-- Enumerates ScreenConnect RMM presence: processes, services, install dirs, and live connections

-- 1. Running ScreenConnect processes (any path)
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)screenconnect|connectwise'
   OR CommandLine =~ '(?i)screenconnect|connectwise'

-- 2. ScreenConnect services (GUID-suffixed service names)
LET svcs = SELECT Name, DisplayName, PathName, StartName, State
FROM wmi(query='SELECT Name, DisplayName, PathName, StartName, State FROM Win32_Service',
         namespace='root/cimv2')
WHERE Name =~ '(?i)ScreenConnect Client'
   OR PathName =~ '(?i)screenconnect'

-- 3. Install directories in standard and user-writable locations
LET files = SELECT FullPath, Mtime, Size
FROM glob(globs=[
  'C:/Program Files (x86)/ScreenConnect Client (*)/**',
  'C:/Program Files/ScreenConnect Client (*)/**',
  'C:/ProgramData/**/ScreenConnect*',
  'C:/Users/*/AppData/Local/**/ScreenConnect*',
  'C:/Users/*/AppData/Roaming/**/ScreenConnect*'
])

-- 4. Live outbound connections from ScreenConnect processes
LET conns = SELECT Pid, Name, Family, Type, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)screenconnect'

SELECT 'process' AS Category, * FROM procs
UNION ALL
SELECT 'service' AS Category, * FROM svcs

# Requires: Run as Administrator
# Bank of America phishing / ScreenConnect abuse — triage and removal runbook
param(
    [switch]$Remove,                                  # Execute removal actions
    [string[]]$AuthorizedServicePrefix = @(),         # e.g. 'ScreenConnect Client (YOUR-AUTH-GUID)'
    [string]$EvidencePath = "$env:TEMP\ScreenConnect_Triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
)

$findings = @()

# 1. Enumerate ScreenConnect services (GUID-suffixed names)
$services = Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match 'ScreenConnect Client' -or $_.PathName -match '(?i)screenconnect'
}
foreach ($svc in $services) {
    $authorized = $false
    foreach ($prefix in $AuthorizedServicePrefix) {
        if ($svc.Name -like "$prefix*") { $authorized = $true }
    }
    $findings += [pscustomobject]@{
        Type = 'Service'; Name = $svc.Name; Path = $svc.PathName
        State = $svc.State; Authorized = $authorized
    }
}

# 2. Enumerate ScreenConnect processes
$procs = Get-Process | Where-Object { $_.Name -match '(?i)screenconnect' }
foreach ($p in $procs) {
    $findings += [pscustomobject]@{
        Type = 'Process'; Name = $p.Name; Path = $p.Path; State = 'Running'; Authorized = $false
    }
}

# 3. Check Run keys and common install locations
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        (Get-ItemProperty $key).PSObject.Properties | Where-Object {
            $_.Value -match '(?i)screenconnect'
        } | ForEach-Object {
            $findings += [pscustomobject]@{
                Type = 'RunKey'; Name = $_.Name; Path = "$key -> $($_.Value)"; State = 'Persist'; Authorized = $false
            }
        }
    }
}

$findings | Export-Csv -Path $EvidencePath -NoTypeInformation
Write-Host "[+] Evidence written to $EvidencePath"
$findings | Format-Table -AutoSize

# 4. Removal (only when -Remove specified and instance is NOT authorized)
if ($Remove) {
    foreach ($svc in ($services | Where-Object { -not ($AuthorizedServicePrefix | ForEach-Object { $svc.Name -like "$_*" }) })) {
        Write-Host "[!] Stopping and removing unauthorized service: $($svc.Name)"
        Stop-Service -Name $svc.Name -Force -ErrorAction SilentlyContinue
        sc.exe delete "$($svc.Name)" | Out-Null
    }
    foreach ($p in $procs) { Stop-Process -Id $p.Id -Force -ErrorAction SilentlyContinue }
    # Clean leftover directories flagged in evidence
    $findings | Where-Object { $_.Type -eq 'Service' -and -not $_.Authorized } | ForEach-Object {
        $dir = ($_.Path -replace '^"?([^"]*\.exe).*','$1' | Split-Path -Parent)
        if ($dir -and (Test-Path $dir)) {
            Write-Host "[!] Removing directory: $dir"
            Remove-Item -Path $dir -Recurse -Force -ErrorAction SilentlyContinue
        }
    }
    Write-Host "[+] Removal pass complete. Re-run without -Remove to verify."
}