ScreenConnect RMM Abuse via WsgiDAV Staging & Cloudflare Tunnels: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Suspicious Script Execution Connecting to Non-Standard Ports
id: 94e8a3b2-1f90-4c5b-9d22-7f1a6e0d8b9c
description: Detects VBScript or Batch scripts initiating network connections to non-standard ports (e.g., 8080) or known bad IPs associated with WsgiDAV staging.
status: experimental
date: 2026/08/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6428b34945f5e8e3e8e8e8e8
tags:
    - attack.execution
    - attack.initial_access
logsource:
    category: process_creation
    product: windows
detection:
    selection_script:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    selection_cli:
        CommandLine|contains:
            - '.vbs'
            - '.bat'
    selection_network:
        DestinationPort: 8080
    condition: selection_script and selection_cli and selection_network
falsepositives:
    - Legitimate administrative scripts connecting to internal web services
level: high
---
title: ScreenConnect RMM Installation from Non-Corporate Source
id: 21f4c5d6-7e8a-4b3c-9a1f-2d3e4f5a6b7c
description: Detects the installation or execution of ScreenConnect (ConnectWise Control) client processes initiated from suspicious paths or signed with non-standard certificates observed in recent campaigns.
status: experimental
date: 2026/08/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6428b34945f5e8e3e8e8e8e8
tags:
    - attack.persistence
    - attack.command_and_control
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        OriginalFileName:
            - 'ScreenConnect.ClientService.exe'
            - 'RemoteControl.Service.exe'
        Image|contains: 'ScreenConnect'
    selection_suspicious_loc:
        CommandLine|contains:
            - '\Temp\'
            - '\Users\Public\'
            - 'AppData\Local\Temp'
    filter_corporate:
        Subject: 'CN=ConnectWise, LLC'
    condition: selection_img and selection_suspicious_loc and not filter_corporate
falsepositives:
    - Legitimate IT admin installing ScreenConnect for temporary remote support
level: critical
---
title: Network Connection to Known Malicious Staging Infrastructure
id: 33g6h7j8-9k0l-1m2n-3o4p-5q6r7s8t9u0v
description: Identifies network connections to specific IP addresses and domains identified in OTX pulses serving as WsgiDAV staging or payload repositories.
status: experimental
date: 2026/08/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6428b34945f5e8e3e8e8e8e8
tags:
    - attack.command_and_control
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '142.202.191.225'
            - '207.174.0.143'
            - '207.189.11.170'
    selection_domain:
        DestinationHostname:
            - 'crestmarkhq.com'
            - 'blog.derrspecial-onlinedmin.live'
    condition: 1 of selection*
falsepositives:
    - None
level: critical


kql
// Hunt for ScreenConnect RMM abuse and staging server connections
// Scope: DeviceNetworkEvents, DeviceProcessEvents
let IoC_IPs = dynamic(["142.202.191.225", "207.174.0.143", "207.189.11.170"]);
let IoC_Domains = dynamic(["crestmarkhq.com", "blog.derrspecial-onlinedmin.live"]);
let IoC_Hashes = dynamic(["9161a8f7f07741db06b9f9a87b6ec7f277faf2ae3a3a661d6eb09cec4e12b920", "dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2"]);

// Network Connections to IOCs
DeviceNetworkEvents
| where RemoteIP in (IoC_IPs) or RemoteUrl has_any (IoC_Domains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort

// Process Creation related to script droppers
| union (DeviceProcessEvents
    | where (ProcessCommandLine contains ".vbs" or ProcessCommandLine contains ".bat") 
       and (FileName in ("wscript.exe", "cscript.exe", "cmd.exe", "powershell.exe"))
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
    )

// File Presence Checks for Hashes
| union (DeviceFileEvents
    | where SHA256 in (IoC_Hashes)
    | project Timestamp, DeviceName, FolderPath, FileName, SHA256
    )


powershell
# IOC Hunt Script for ScreenConnect Abuse Campaign
# Requires Administrative Privileges

Write-Host "Starting hunt for ScreenConnect RMM Abuse Indicators..." -ForegroundColor Cyan

# 1. Check for known malicious file hashes
$maliciousHashes = @( 
    "9161a8f7f07741db06b9f9a87b6ec7f277faf2ae3a3a661d6eb09cec4e12b920",
    "dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2"
)

Write-Host "Scanning for specific file hashes..." -ForegroundColor Yellow
$drives = Get-PSDrive -PSProvider FileSystem
foreach ($drive in $drives) {
    Get-ChildItem -Path $drive.Root -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0 } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -in $maliciousHashes) {
            Write-Host "[MALICIOUS FILE FOUND] $($_.FullName) - Hash: $hash" -ForegroundColor Red
        }
    }
}

# 2. Check for active ScreenConnect processes not running from standard Program Files paths
Write-Host "Checking ScreenConnect process integrity..." -ForegroundColor Yellow
$suspiciousProcesses = Get-Process | Where-Object { 
    $_.ProcessName -like "*ScreenConnect*" -or 
    $_.ProcessName -like "*ConnectWise*" -or
    $_.ProcessName -like "*RemoteControl*"
}

foreach ($proc in $suspiciousProcesses) {
    $path = $proc.Path
    if ($path -notmatch "Program Files" -and $path -ne "") {
        Write-Host "[SUSPICIOUS PROCESS] $($proc.ProcessName) running from non-standard path: $path" -ForegroundColor Red
    }
}

# 3. Network Connection Check for Staging IPs
$stagingIPs = @("142.202.191.225", "207.174.0.143", "207.189.11.170")
Write-Host "Checking active network connections to staging infrastructure..." -ForegroundColor Yellow

$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($ip in $stagingIPs) {
    $hits = $connections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($hits) {
        foreach ($hit in $hits) {
            $process = Get-Process -Id $hit.OwningProcess -ErrorAction SilentlyContinue
            Write-Host "[C2 DETECTED] Connection to $ip from PID $($hit.OwningProcess) - $($process.ProcessName)" -ForegroundColor Red
        }
    }
}

Write-Host "Hunt complete." -ForegroundColor Green