---
title: ScreenConnect Spawning Shell or Script Interpreter
id: 3f8a2c41-9b1e-4d7a-a6c2-8e5f1b9d3a07
status: experimental
description: Detects ScreenConnect client service spawning command shells or script interpreters, consistent with SCKit-style execution through an RMM session or malicious service activity.
references:
  - https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/
  - https://attack.mitre.org/techniques/T1219/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.Service.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate MSP automation and remote scripts executed by technicians via ScreenConnect Backstage or toolbox functions — baseline known packages and technician activity windows
level: high
---
title: Persistence via ScreenConnect Service Manipulation
id: 7c1d4e92-6a3b-4f85-b2d9-1e8c4a7f5b06
status: experimental
description: Detects creation or modification of Windows services referencing ScreenConnect paths by processes other than the ScreenConnect installer or updater, indicating tampering or SCKit-style persistence piggybacking on the RMM install.
references:
  - https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1543.003
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith:
      - '\sc.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'ScreenConnect'
  selection_verbs:
    CommandLine|contains:
      - ' create '
      - ' config '
      - 'New-Service'
      - 'Set-Service'
      - 'binpath'
      - 'binPath'
  filter_installer:
    CommandLine|contains:
      - 'ScreenConnect.ClientSetup'
      - 'ScreenConnect Installer'
  condition: selection_sc and selection_verbs and not filter_installer
falsepositives:
  - MSP deployment scripts that legitimately re-register ScreenConnect services during onboarding — scope to change windows
level: high
---
title: Unsigned Binary Execution from ScreenConnect Working Directory
id: b29e6a14-4d8c-4f19-9a73-2c6d8e1f4b52
status: experimental
description: Detects process execution from ScreenConnect temporary, toolbox, or user data directories by binaries that are not the ScreenConnect client itself — a common staging location for payloads pushed through compromised sessions.
references:
  - https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\ScreenConnect Client\'
      - '\ScreenConnect\App_Data\'
      - '\Documents\ConnectWiseControl\'
  filter_known:
    Image|endswith:
      - '\ScreenConnect.Client.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\ScreenConnect.SessionClient.exe'
  condition: selection and not filter_known
falsepositives:
  - Legitimate third-party tools staged in the ScreenConnect toolbox by technicians — maintain an allowlist of approved toolbox utilities
level: medium

// Hunt: ScreenConnect spawning shells/script interpreters or staging unexpected binaries
// Scope: all endpoints, with emphasis on MSP technician workstations
let Lookback = 14d;
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","wmic.exe","msbuild.exe","installutil.exe","regsvcs.exe"]);
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName has_any ("ScreenConnect.ClientService.exe","ScreenConnect.Service.exe","ScreenConnect.WindowsClient.exe")
| where FileName has_any (SuspiciousChildren)
| extend ChildSHA256 = SHA256, ParentCommand = InitiatingProcessCommandLine
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
            Commands = make_set(ProcessCommandLine, 20),
            Accounts = make_set(AccountName, 10)
  by DeviceName, FileName, ChildSHA256, ParentCommand
| extend DistinctCommands = array_length(Commands)
| order by LastSeen desc;
// Companion: outbound network connections from ScreenConnect child processes
DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName has_any (SuspiciousChildren)
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName has "ScreenConnect"
    | project DeviceName, ProcessId, Timestamp
) on DeviceName
| where RemoteIPType == "Public"
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP, 25), Ports = make_set(RemotePort, 10)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Connections desc;

-- SCKit / ScreenConnect abuse triage artifact
-- Sweep: suspicious children of ScreenConnect, staged binaries in RMM paths, service config

-- 1. ScreenConnect-spawned shells and LOLBins
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)screenconnect'
   OR Name =~ '(?i)screenconnect'

-- 2. Unexpected executables staged in ScreenConnect working/toolbox directories
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
  'C:/Program Files (x86)/ScreenConnect Client*/**/*.exe',
  'C:/Program Files/ScreenConnect Client*/**/*.exe',
  'C:/ProgramData/**/ScreenConnect*/**/*.exe',
  'C:/Users/*/Documents/ConnectWiseControl/**/*.exe'
])
WHERE FullPath !~ '(?i)ScreenConnect\.(Client|ClientService|WindowsClient|SessionClient|Upstream)\.exe'

-- 3. ScreenConnect service registration and binary path (detect tampering / replaced binPath)
SELECT Name, DisplayName, PathName, StartName, State, StartMode
FROM wmi(query='SELECT Name, DisplayName, PathName, StartName, State, StartMode FROM Win32_Service WHERE Name LIKE "%ScreenConnect%"', namespace='root/cimv2')

-- 4. Active network connections from ScreenConnect-related processes
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)screenconnect|powershell|cmd|rundll32'
  AND Status =~ 'ESTAB'

# SCKit / ScreenConnect Abuse Triage & Hardening Script - Security Arsenal
# Run elevated. Outputs a consolidated report for IR scoping.

$report = @()

# 1. Inventory ScreenConnect services and flag non-standard binary paths

```powershell
Get-CimInstance Win32_Service | Where-Object { $_.Name -like '*ScreenConnect*' -or $_.PathName -like '*ScreenConnect*' } | ForEach-Object {

$signed = $null
$binPath = if ($_.PathName -match '"([^"]+)"') { $Matches[1] } else { ($_.PathName -split ' ')[0] }
if (Test-Path $binPath) { $signed = (Get-AuthenticodeSignature $binPath).Status }
$report += [pscustomobject]@{
    Check = 'Service'; Name = $_.Name; Detail = $_.PathName
    StartAccount = $_.StartName; Signature = $signed
    Risk = if ($signed -ne 'Valid') { 'HIGH - unsigned or invalid signature' } else { 'Review' }
}