SCKit Worm & RelayTrap: Rogue ScreenConnect Deployment Hits 288 Endpoints — Detection & Hunt Pack

---
title: Rogue ScreenConnect Client Service Installation — SCKit Worm
id: 8f2a1c4e-7b3d-4f9a-a1e2-5c6d7e8f9a0b
status: experimental
description: Detects installation of ScreenConnect client services outside of known managed deployments, consistent with SCKit worm rogue RMM deployment activity
author: Security Arsenal Threat Intelligence
references:
    - https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
date: 2026/11/12
modified: 2026/11/12
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.persistence
    - attack.t1543.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_service_install:
        EventID: 7045
        ServiceName|contains: 'ScreenConnect'
    selection_cmdline:
        Image|endswith: '\ScreenConnect.ClientService.exe'
        CommandLine|contains:
            - 'homedns.org'
            - 'gotdns.org'
            - 'payproofkit.com'
            - 'digitaldownloads'
    condition: selection_service_install or selection_cmdline
falsepositives:
    - Legitimate IT-managed ScreenConnect deployments (whitelist known instance GUIDs and service names)
level: high
---
title: SCKit / RelayTrap C2 Communication to Dynamic DNS Infrastructure
id: 9d3b2e5f-6c4a-5e8b-b2f3-6d7e8f9a0b1c
status: experimental
description: Detects network connections to known SCKit worm and RelayTrap C2 infrastructure including dynamic DNS hosts and relay endpoints
author: Security Arsenal Threat Intelligence
references:
    - https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
date: 2026/11/12
modified: 2026/11/12
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1572
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'soxnewwork.homedns.org'
            - 'newnewnew.gotdns.org'
            - 'cdn007-digitaldownloads.com'
            - 'sc.payproofkit.com'
            - 'ns.mo7sen.dev'
    selection_ip:
        DestinationIp:
            - '185.99.255.28'
            - '155.94.150.39'
    selection_dyndns_heuristic:
        DestinationHostname|endswith:
            - '.homedns.org'
            - '.gotdns.org'
    condition: selection_domain or selection_ip or selection_dyndns_heuristic
falsepositives:
    - Rare; dynamic DNS resolution from enterprise endpoints is anomalous by default
level: critical
---
title: Suspicious Session Cookie Access by Non-Browser Process — RelayTrap
id: 1a4c3f6d-8d5b-6f9c-c3e4-7e8f9a0b1c2d
status: experimental
description: Detects non-browser processes accessing browser cookie stores, consistent with RelayTrap session cookie theft enabling worm propagation to technician workstations
author: Security Arsenal Threat Intelligence
date: 2026/11/12
modified: 2026/11/12
tags:
    - attack.credential_access
    - attack.t1539
    - attack.collection
logsource:
    category: file_access
    product: windows
detection:
    selection_paths:
        TargetFilename|contains:
            - '\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies'
            - '\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies'
            - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    filter_av:
        Image|contains:
            - '\ProgramData\Microsoft\Windows Defender\'
    condition: selection_paths and not filter_browsers and not filter_av
falsepositives:
    - Endpoint backup agents, forensic tooling, some EDR scanners (whitelist known-good)
level: high

// SCKit Worm & RelayTrap Hunt — Rogue ScreenConnect + C2 + Cookie Theft
// Microsoft Sentinel / Defender XDR | Lookback: 30 days
let C2Domains = dynamic(["soxnewwork.homedns.org", "newnewnew.gotdns.org", "cdn007-digitaldownloads.com", "sc.payproofkit.com", "ns.mo7sen.dev"]);
let C2IPs = dynamic(["185.99.255.28", "155.94.150.39"]);
let DynDNS = dynamic([".homedns.org", ".gotdns.org"]);
let NetworkHits = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (C2Domains)
   or RemoteIP in (C2IPs)
   or RemoteUrl endswith ".homedns.org"
   or RemoteUrl endswith ".gotdns.org"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| extend HitType = "C2_Network";
let RogueSC = DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName has_any ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe")
   or ProcessCommandLine has "screenconnect"
| where ProcessCommandLine has_any ("homedns", "gotdns", "payproofkit", "digitaldownloads", "mo7sen")
   or FolderPath !has_any ("C:\\Program Files\\ScreenConnect", "C:\\Program Files (x86)\\ScreenConnect") // tune to your managed path
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, AccountName
| extend HitType = "Rogue_ScreenConnect";
let RelayURL = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl contains "mo7sen.dev" or RemoteUrl contains "EadF.php"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| extend HitType = "RelayTrap_Endpoint";
union NetworkHits, RogueSC, RelayURL
| sort by Timestamp desc

# SCKit / RelayTrap IOC & Artifact Hunt — Run elevated on endpoints or via EDR Live Response
# Checks: rogue ScreenConnect services, DynDNS DNS cache, established C2 connections, cookie store access artifacts

$C2Hosts = @("soxnewwork.homedns.org","newnewnew.gotdns.org","cdn007-digitaldownloads.com","sc.payproofkit.com","ns.mo7sen.dev")
$C2IPs   = @("185.99.255.28","155.94.150.39")
$DynDNS  = @("homedns.org","gotdns.org")

Write-Host "=== [1] Rogue ScreenConnect Services ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match "ScreenConnect" -and ($_.PathName -notmatch "Program Files")
} | Select-Object Name, DisplayName, State, PathName, StartName | Format-List

Write-Host "=== [2] All ScreenConnect Service Instances (validate against known-good GUIDs) ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object { $_.Name -match "ScreenConnect" } |
    Select-Object Name, DisplayName, State, PathName | Format-Table -AutoSize

Write-Host "=== [3] DNS Cache — C2 / Dynamic DNS Resolution ===" -ForegroundColor Cyan
Get-DnsClientCache | Where-Object {
    $e = $_.Entry; ($C2Hosts + $DynDNS | Where-Object { $e -like "*$_*" })
} | Select-Object Entry, Data, TimeToLive | Format-Table -AutoSize

Write-Host "=== [4] Active/Recent Connections to C2 IPs ===" -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $C2IPs -contains $_.RemoteAddress } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess,
        @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} | Format-Table -AutoSize

Write-Host "=== [5] ScreenConnect Client Artifacts on Disk (non-standard paths) ===" -ForegroundColor Cyan
$paths = @("$env:ProgramFiles","${env:ProgramFiles(x86)}","$env:ProgramData","$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -Filter "ScreenConnect*" -ErrorAction SilentlyContinue -Depth 3 |
        Where-Object { $_.FullName -notmatch "Program Files" } |
        Select-Object FullName, CreationTime, LastWriteTime
}

Write-Host "=== [6] Recent Browser Cookie Store Modifications (RelayTrap staging) ===" -ForegroundColor Cyan
$cookiePaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Network\Cookies",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Network\Cookies"
)
foreach ($cp in $cookiePaths) {
    if (Test-Path $cp) {
        Get-Item $cp | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
            Select-Object FullName, LastWriteTime, LastAccessTime
    }
}

Write-Host "=== [7] Scheduled Tasks referencing ScreenConnect or DynDNS ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $t = $_
    $t.Actions | Where-Object {
        $_.Execute -match "ScreenConnect" -or $_.Arguments -match "homedns|gotdns|payproofkit|mo7sen"
    } | ForEach-Object { [PSCustomObject]@{ Task=$t.TaskName; Action=$_.Execute; Args=$_.Arguments } }
} | Format-Table -AutoSize

Write-Host "`nHunt complete. Any hits in sections 1, 3, 4, or 5 warrant immediate isolation." -ForegroundColor Yellow