ScreenConnect RMM Abuse + SockTz AI-Enabled Intrusions + Teams Help Desk Vishing: OTX Pulse Analysis — Enterprise Detection Pack

---
title: ScreenConnect RMM Agent Execution from Unapproved Path
description: Detects ScreenConnect client execution from non-standard directories or with suspicious parent processes, consistent with RMM abuse campaigns delivering ScreenConnect via VBScript/batch droppers.
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\ScreenConnect.Client.exe'
  filter_approved:
    Image|startswith:
      - 'C:\Program Files\ScreenConnect Client'
      - 'C:\Program Files (x86)\ScreenConnect Client'
      - 'C:\Program Files\ConnectWise'
  condition: selection_img and not filter_approved
falsepositives:
  - Legitimate ScreenConnect deployments installed to custom paths
fields:
  - CommandLine
  - ParentImage
  - User
tags:
  - attack.t1219
  - attack.t1102
date: 2026/09/03
---
title: VBScript or Batch Dropper Spawning Script or .NET Payload Retrieval
description: Detects wscript/cscript or cmd batch execution spawning curl, certutil, bitsadmin, or powershell to retrieve payloads — matching the VBScript dropper / batch loader chain staging from WsgiDAV servers.
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_parent:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\cmd.exe'
  selection_child:
    Image|endswith:
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - ':8080'
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Software deployment scripts run via batch wrappers
fields:
  - CommandLine
  - ParentCommandLine
tags:
  - attack.t1059.005
  - attack.t1105
  - attack.t1059.003
date: 2026/09/03
---
title: Outbound Connection to Dynamic DNS or RMM Campaign Infrastructure
description: Detects network connections to DuckDNS hostnames, identified SockTz C2, Teams-vishing staging IPs, or WsgiDAV staging infrastructure from the OTX pulses.
author: Security Arsenal Threat Intelligence
status: experimental
logsource:
  category: network_connection
  product: windows
level: critical
detection:
  selection_dns:
    DestinationHostname|endswith: '.duckdns.org'
  selection_ip:
    DestinationIp:
      - '207.174.0.143'
      - '207.189.11.170'
      - '167.148.195.53'
      - '5.181.3.106'
      - '178.130.47.46'
      - '80.66.72.215'
      - '185.155.99.161'
      - '45.8.157.185'
      - '2.56.172.214'
      - '185.234.67.53'
      - '136.0.20.6'
  selection_domain:
    DestinationHostname|contains:
      - 'crestmarkhq.com'
      - 'derrspecial-onlinedmin.live'
  condition: 1 of selection_*
falsepositives:
  - Rare legitimate DuckDNS usage by internal tooling; investigate per-environment
fields:
  - DestinationHostname
  - DestinationIp
  - DestinationPort
  - Image
tags:
  - attack.t1071.001
  - attack.t1568.002
  - attack.t1090
date: 2026/09/03

// Security Arsenal — OTX Pulse Hunt: ScreenConnect RMM abuse, SockTz, Teams vishing infrastructure
// Hunts network connections and suspicious process chains across the last 14 days
let BadIPs = dynamic(["207.174.0.143","207.189.11.170","167.148.195.53","5.181.3.106","178.130.47.46","80.66.72.215","185.155.99.161","45.8.157.185","2.56.172.214","185.234.67.53","136.0.20.6"]);
let BadHosts = dynamic(["crestmarkhq.com","blog.derrspecial-onlinedmin.live","m-doxa-apodo.duckdns.org","m-doxa-geo.duckdns.org","m-doxa-intel.duckdns.org","m-doxa-vacunas.duckdns.org"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP in (BadIPs) or RemoteUrl has_any (BadHosts) or RemoteUrl endswith ".duckdns.org"
| project HitType="NetworkIOC", TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine;
let DropperChain = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("wscript.exe","cscript.exe","cmd.exe","mshta.exe")
| where FileName in~ ("powershell.exe","curl.exe","certutil.exe","bitsadmin.exe")
| where ProcessCommandLine has_any ("http://","https://",":8080","screenconnect","duckdns")
| project HitType="DropperChain", TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine;
let RMMAnomaly = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has_any ("ScreenConnect","ConnectWise")
| where not (FolderPath startswith @"C:\Program Files")
| project HitType="RMMAnomaly", TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName;
union NetworkHits, DropperChain, RMMAnomaly
| sort by TimeGenerated desc

# Security Arsenal — OTX Pulse IOC Hunt (ScreenConnect abuse / SockTz / Teams vishing)
# Run elevated on endpoints; outputs findings to console and CSV
$badIPs = @("207.174.0.143","207.189.11.170","167.148.195.53","5.181.3.106","178.130.47.46","80.66.72.215","185.155.99.161","45.8.157.185","2.56.172.214","185.234.67.53","136.0.20.6")
$badHosts = @("crestmarkhq.com","derrspecial-onlinedmin.live","duckdns.org")
$findings = @()

# 1. Active and historical TCP connections to known-bad IPs
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $findings += [PSCustomObject]@{Type="NetworkConnection"; Detail="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)] PID $($_.OwningProcess) $($proc.ProcessName)"}
}

# 2. DNS client cache for malicious / dynamic-DNS hostnames
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $n=$_.Entry; ($badHosts | Where-Object { $n -like "*$_*" }) } | ForEach-Object {
    $findings += [PSCustomObject]@{Type="DNSCache"; Detail="$($_.Entry) -> $($_.Data)"}
}

# 3. ScreenConnect / RMM services and persistence outside approved paths
Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "ScreenConnect|ConnectWise|cloudflared" } | ForEach-Object {
    $suspicious = $_.PathName -notmatch "^"?C:\Program Files"
    $findings += [PSCustomObject]@{Type="RMMService$(if($suspicious){'-SUSPICIOUS'})"; Detail="$($_.Name) | $($_.State) | $($_.PathName)"}
}

# 4. Run-key and scheduled task persistence referencing scripts, RMM, or tunnels
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match "screenconnect|cloudflared|duckdns|\.vbs|wscript|appdata" } | ForEach-Object {
            $findings += [PSCustomObject]@{Type="RunKey"; Detail="$key :: $($_.Name) = $($_.Value)"}
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { ($_.Actions.Execute -match "wscript|powershell|curl") -or ($_.Actions.Arguments -match "http|duckdns|screenconnect|cloudflared") } | ForEach-Object {
    $findings += [PSCustomObject]@{Type="ScheduledTask"; Detail="$($_.TaskName) | $($_.Actions.Execute) $($_.Actions.Arguments)"}
}

# 5. VBScript / batch dropper artifacts in user-writable temp locations
$dropPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:PUBLIC")
foreach ($p in $dropPaths) {
    Get-ChildItem -Path $p -Recurse -Include *.vbs,*.bat,*.cs -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } | ForEach-Object {
        $findings += [PSCustomObject]@{Type="DropperFile"; Detail="$($_.FullName) (modified $($_.LastWriteTime))"}
    }
}

if ($findings) { $findings | Format-Table -AutoSize; $findings | Export-Csv -Path ".\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation } else { Write-Host "[+] No indicators of compromise found." }