SMOKE#SCREEN Campaign: Fake Adobe & Zoom Updates Deploying ScreenConnect RMM - Detection & Hardening Guide

---
title: SMOKE#SCREEN - Suspicious ScreenConnect Installation from Non-IT Sources
id: 8a4b3d21-9f7c-4e2a-a8b5-1c3d4e5f6a7b
status: experimental
description: Detects ScreenConnect installation initiated by non-standard parent processes, characteristic of SMOKE#SCREEN campaign delivery vectors.
references:
  - https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1543
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'ScreenConnect.ClientService.exe'
      - 'ScreenConnect.WindowsClient.exe'
      - '\ScreenConnect\'
  filter_legit:
    ParentImage|contains:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
      - 'C:\Windows\System32\'
    ParentImage|endswith:
      - '\msiexec.exe'
      - '\services.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate ScreenConnect deployment by authorized IT staff using custom installers
level: high
---
title: SMOKE#SCREEN - Fake Adobe/Zoom Update Launcher Patterns
date: 2026/08/15
id: 7b3a2c10-8e6b-3d1z-z9a4-0b2c3d4e5f6a
status: experimental
description: Detects suspicious processes executing from temporary directories with Adobe/Zoom update-related naming conventions, indicative of SMOKE#SCREEN social engineering lures.
references:
  - https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html
author: Security Arsenal
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\Windows\Temp\'
  selection_names:
    Image|contains:
      - 'Adobe_Update'
      - 'AdobeReaderUpdate'
      - 'Zoom_Installer'
      - 'Zoom_Update'
      - 'SoftwareUpdate'
  selection_suspicious:
    CommandLine|contains:
      - '/silent'
      - '/install'
      - '/update'
  condition: all of selection_*
falsepositives:
  - Legitimate Adobe/Zoom update mechanisms (rarely execute from temp)
level: high
---
title: SMOKE#SCREEN - ScreenConnect Network Connections to Non-Approved Destinations
id: 6c2a1b00-7d5a-2c0y-y8z3-9a0b1c2d3e4f
status: experimental
description: Detects outbound network connections from ScreenConnect processes to external hosts not in approved infrastructure.
references:
  - https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1095
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|contains:
      - 'ScreenConnect'
  selection_port:
    DestinationPort:
      - 8080
      - 443
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '127.'
  filter_approved:
    DestinationHostname|contains:
      - 'your-approved-screenconnect-server.domain.com'
  condition: selection_process and selection_port and not 1 of filter_*
falsepositives:
  - Connections to newly provisioned legitimate ScreenConnect servers
level: medium

// SMOKE#SCREEN Campaign Hunt: ScreenConnect Installation Patterns
// Hunt for ScreenConnect processes with suspicious parent processes
let LegitimateParents = dynamic(['msiexec.exe', 'services.exe', 'svchost.exe']);
let ScreenConnectProcesses = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has_any ('ScreenConnect.ClientService.exe', 'ScreenConnect.WindowsClient.exe') 
   orFolderPath contains 'ScreenConnect'
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, 
          ProcessCommandLine, SHA256, InitiatingProcessFileName, 
          InitiatingProcessFolderPath, InitiatingProcessId;
// Identify suspicious parent processes
let SuspiciousInstalls = ScreenConnectProcesses
| where InitiatingProcessFileName !in (LegitimateParents)
   and InitiatingProcessFolderPath !startswith 'C:\Program Files'
   and InitiatingProcessFolderPath !startswith 'C:\Program Files (x86)';
// Identify executions from temp directories with update-related names
let FakeUpdateLaunchers = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ('\Temp\', '\AppData\Local\Temp\')
| where FileName has_any ('Adobe', 'Zoom', 'Update', 'Install')
| where ProcessCommandLine has_any ('/silent', '/install', '/update', '-s')
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, 
          ProcessCommandLine, SHA256;
// Correlate with network connections to identify C2
let ScreenConnectNetwork = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has 'ScreenConnect'
| where RemotePort in (8080, 443)
| where not(RemoteIP has_any ('10.', '192.168.', '172.16.', '127.'));
// Union all detections
union SuspiciousInstalls, FakeUpdateLaunchers, ScreenConnectNetwork
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by 
  DeviceName, FileName, SHA256
| where Count > 0
| order by LastSeen desc

-- SMOKE#SCREEN Campaign Hunt: ScreenConnect Persistence and Network Artifacts
-- Hunt for ScreenConnect processes and persistence mechanisms
LET SuspiciousParents = SELECT Name FROM array(globs='*')
  WHERE Name NOT IN ('services.exe', 'msiexec.exe', 'svchost.exe');

-- Identify ScreenConnect processes
SELECT Pid, Name, Exe, Username, CommandLine, ParentPid, CreateTime
FROM pslist()
WHERE Name =~ 'ScreenConnect'
   OR Exe =~ 'ScreenConnect'
   OR CommandLine =~ 'ScreenConnect'

-- Hunt for ScreenConnect services with randomized names
SELECT Name, DisplayName, ImagePath, Started, StartMode, State, ProcessId
FROM win_service()
WHERE ImagePath =~ 'ScreenConnect'
   OR DisplayName =~ 'ScreenConnect'
   OR (ImagePath =~ '.*\\.*\.exe' AND ImagePath !~ 'Program Files')

-- Check for persistence in startup folders
SELECT FullPath, Mtime, Atime, Size
FROM glob(globs='C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*')
WHERE FullPath =~ '.*\\(ScreenConnect|Update|Install).*'

-- Identify network connections from ScreenConnect processes
SELECT Fd, RemoteAddr, RemotePort, State, Pid
FROM netstat()
WHERE Pid IN (SELECT Pid FROM pslist() WHERE Name =~ 'ScreenConnect')
   AND RemotePort IN (8080, 443)
   AND RemoteAddr !~ '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)'

-- Scan for ScreenConnect artifacts in common installation directories
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs=C
  'C:\ProgramData\**\ScreenConnect*'
  'C:\Windows\Temp\**\ScreenConnect*'
  'C:\Users\*\AppData\Local\Temp\**\ScreenConnect*'
)
WHERE Size > 0

# SMOKE#SCREEN Campaign Remediation Script
# Version: 1.0
# Author: Security Arsenal
# Purpose: Detect and remediate unauthorized ScreenConnect installations

param(
    [string[]]$AuthorizedHosts = @('approved-server1.domain.com', 'approved-server2.domain.com'),
    [switch]$AuditOnly,
    [switch]$RemoveUnauthorized
)

function Write-Log {
    param([string]$Message, [string]$Level = 'INFO')
    $timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    Write-Host "[$timestamp] [$Level] $Message"
}

function Get-ScreenConnectServices {
    Write-Log 'Enumerating ScreenConnect services...'
    $services = Get-CimInstance Win32_Service | Where-Object { 
        $_.DisplayName -like '*ScreenConnect*' -or 
        $_.PathName -like '*ScreenConnect*' -or
        $_.Name -like '*ScreenConnect*'
    }
    return $services
}

function Get-ScreenConnectProcesses {
    Write-Log 'Enumerating ScreenConnect processes...'
    $processes = Get-Process | Where-Object { 
        $_.ProcessName -like '*ScreenConnect*' -or 
        $_.Path -like '*ScreenConnect*'
    }
    return $processes
}

function Get-ScreenConnectConnections {
    Write-Log 'Checking for ScreenConnect network connections...'
    $connections = Get-NetTCPConnection | Where-Object { 
        $_.OwningProcess -in (Get-Process | Where-Object { 
            $_.ProcessName -like '*ScreenConnect*' }).Id -and 
        $_.RemotePort -in @(8080, 443)
    }
    return $connections
}

function Get-ScreenConnectFiles {
    Write-Log 'Scanning for ScreenConnect installation files...'
    $paths = @(
        'C:\Program Files\ScreenConnect*',
        'C:\Program Files (x86)\ScreenConnect*',
        'C:\ProgramData\ScreenConnect*',
        'C:\Users\*\AppData\Roaming\ScreenConnect*',
        'C:\Users\*\AppData\Local\Temp\*ScreenConnect*'
    )
    $files = @()
    foreach ($path in $paths) {
        $files += Get-ChildItem -Path $path -ErrorAction SilentlyContinue -Recurse
    }
    return $files
}

function Test-AuthorizedHost {
    param([string]$Hostname)
    foreach ($authorized in $AuthorizedHosts) {
        if ($Hostname -like "*$authorized*") {
            return $true
        }
    }
    return $false
}

# Main execution
Write-Log '=== SMOKE#SCREEN Campaign Remediation Script Started ==='

# Detect ScreenConnect components
$services = Get-ScreenConnectServices
$processes = Get-ScreenConnectProcesses
$connections = Get-ScreenConnectConnections
$files = Get-ScreenConnectFiles

# Report findings
if ($services) {
    Write-Log "Found $($services.Count) ScreenConnect services:" 'WARNING'
    $services | ForEach-Object { Write-Log "  - Service: $($_.Name) | Path: $($_.PathName)" 'WARNING' }
} else {
    Write-Log 'No ScreenConnect services detected.'
}

if ($processes) {
    Write-Log "Found $($processes.Count) ScreenConnect processes:" 'WARNING'
    $processes | ForEach-Object { Write-Log "  - Process: $($_.ProcessName) | PID: $($_.Id) | Path: $($_.Path)" 'WARNING' }
} else {
    Write-Log 'No ScreenConnect processes detected.'
}

if ($connections) {
    Write-Log "Found $($connections.Count) ScreenConnect network connections:" 'WARNING'
    foreach ($conn in $connections) {
        try {
            $remoteHost = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
            $isAuthorized = Test-AuthorizedHost -Hostname $remoteHost
            $status = if ($isAuthorized) { 'AUTHORIZED' } else { 'UNAUTHORIZED' }
            Write-Log "  - Remote: $($conn.RemoteAddress):$($conn.RemotePort) | Hostname: $remoteHost | Status: $status" 'WARNING'
        } catch {
            Write-Log "  - Remote: $($conn.RemoteAddress):$($conn.RemotePort) | Status: UNKNOWN (DNS resolution failed)" 'WARNING'
        }
    }
} else {
    Write-Log 'No ScreenConnect network connections detected.'
}

if ($files) {
    Write-Log "Found $($files.Count) ScreenConnect-related files." 'INFO'
} else {
    Write-Log 'No ScreenConnect files found in standard locations.'
}

# Remediation actions
if ($RemoveUnauthorized -and !$AuditOnly) {
    Write-Log 'Starting remediation of unauthorized ScreenConnect components...' 'WARNING'
    
    # Stop and remove unauthorized services
    if ($services) {
        foreach ($svc in $services) {
            Write-Log "Stopping and removing service: $($svc.Name)" 'WARNING'
            try {
                Stop-Service -Name $svc.Name -Force -ErrorAction SilentlyContinue
                $svc | Remove-CimInstance
                Write-Log "Successfully removed service: $($svc.Name)"
            } catch {
                Write-Log "Failed to remove service: $($svc.Name) - $_" 'ERROR'
            }
        }
    }
    
    # Terminate unauthorized processes
    if ($processes) {
        foreach ($proc in $processes) {
            Write-Log "Terminating process: $($proc.ProcessName) (PID: $($proc.Id))" 'WARNING'
            try {
                Stop-Process -Id $proc.Id -Force
                Write-Log "Successfully terminated process: $($proc.ProcessName)"
            } catch {
                Write-Log "Failed to terminate process: $($proc.ProcessName) - $_" 'ERROR'
            }
        }
    }
    
    # Block network connections to unauthorized ScreenConnect hosts
    if ($connections) {
        Write-Log 'Creating firewall rules to block unauthorized ScreenConnect connections...' 'WARNING'
        foreach ($conn in $connections) {
            try {
                $remoteHost = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
                if (!(Test-AuthorizedHost -Hostname $remoteHost)) {
                    $ruleName = "Block-ScreenConnect-$($conn.RemoteAddress)-$($conn.RemotePort)"
                    New-NetFirewallRule -DisplayName $ruleName -Direction Outbound `
                        -RemoteAddress $conn.RemoteAddress -RemotePort $conn.RemotePort `
                        -Protocol TCP -Action Block -ErrorAction SilentlyContinue
                    Write-Log "Created firewall rule: $ruleName"
                }
            } catch {
                Write-Log "Failed to create firewall rule for $($conn.RemoteAddress):$($conn.RemotePort) - $_" 'ERROR'
            }
        }
    }
    
    Write-Log 'Remediation completed. Please investigate system logs for additional compromise indicators.' 'WARNING'
}

Write-Log '=== SMOKE#SCREEN Campaign Remediation Script Completed ==='

# Generate summary report
$summary = @{
    Timestamp = Get-Date
    ServicesFound = $services.Count
    ProcessesFound = $processes.Count
    ConnectionsFound = $connections.Count
    FilesFound = $files.Count
    AuditMode = $AuditOnly
    RemediationExecuted = $RemoveUnauthorized
} | ConvertTo-Json

Write-Log "Summary Report: $summary"