Microsoft Threat Intelligence has publicly attributed a large-scale ConnectWise supply chain attack to Storm-0940, a China-linked threat actor that leveraged an AI-enabled penetration-testing tool to automate and dramatically accelerate its intrusion workflow. The campaign impacted more than 2,200 tenants — a scale that should concern every organization running remote monitoring and management (RMM) infrastructure, every MSP downstream of ConnectWise tooling, and every SOC that treats RMM traffic as implicitly trusted.
This is the story defenders have been predicting since generative AI tooling matured: nation-state operators industrializing intrusion operations. When an actor can use AI-assisted tooling to compress reconnaissance, exploitation, and lateral movement into hours instead of weeks, your detection window shrinks proportionally. If your telemetry, baselines, and containment playbooks were built for human-speed adversaries, they are now structurally insufficient.
The at-risk population is broad: any organization with ConnectWise ScreenConnect deployed (self-hosted or cloud), MSPs and MSSPs whose tenants inherit trust relationships, and any environment where RMM agents are excluded from EDR scrutiny — which, in our incident response experience, describes a disturbing number of production networks.
Technical Analysis
Threat Actor Profile
Storm-0940 is a China-nexus actor tracked by Microsoft. The group has historically targeted perimeter and remote access infrastructure, and this campaign fits that operational pattern: compromise a trusted management plane, then ride existing trust relationships downstream at scale. Supply chain compromise of an RMM platform is among the highest-leverage intrusion vectors available — the RMM agent is, by design, a remote code execution capability with legitimate credentials, signed binaries, and deep endpoint privileges.
The Attack Chain (Defender's View)
While Microsoft has not published a CVE for this campaign, the observable attack chain follows a pattern DFIR teams should recognize:
- Initial access via the ConnectWise trust plane. The actor abused the ScreenConnect/ConnectWise management infrastructure to reach downstream tenants. For defenders, the critical insight is that initial execution arrives through a trusted, signed channel — traditional application control and reputation-based filtering will not flag it.
- AI-accelerated post-exploitation. The actor employed an AI-enabled penetration-testing tool to automate target enumeration, credential access attempts, and movement decisions across 2,200+ tenants. The observable signature of AI-driven automation is velocity and uniformity: near-identical command sequences executed across many hosts in compressed timeframes, enumeration commands issued back-to-back without human typing latency, and rapid pivot decisions.
- Execution through the RMM agent. Commands and payloads are delivered via the ScreenConnect service processes (
ScreenConnect.ClientService.exe,ScreenConnect.Service.exe, and the session/back-end shell mechanisms), which spawn child processes with SYSTEM privileges. - Persistence and staging. Consistent with Storm-0940 tradecraft, expect webshell-style staging on exposed infrastructure, unauthorized service creation, and abuse of legitimate administrative tooling for credential harvesting and lateral movement.
Why This Is Harder to Detect Than a Typical Intrusion
Three compounding factors make this campaign a worst-case detection scenario:
- Living-off-the-platform execution. Everything the actor does is, at the binary level, legitimate ScreenConnect functionality. The malicious signal lives in behavioral context: session timing, command content, source operator identity, and cross-tenant patterns.
- AI-driven speed. Automated enumeration and movement compress the attack timeline. Batch-style detections (daily correlation jobs, weekly hunt cadences) will consistently arrive after the actor has already achieved objectives.
- Blast radius via tenancy. A single compromise of the management plane propagates to thousands of downstream environments. If you are an MSP client, your exposure is inherited, and your contract should tell you whether your provider's RMM telemetry is even visible to you.
Exploitation Status
This is confirmed active exploitation at scale — over 2,200 tenants impacted, with nation-state attribution from Microsoft. This is not theoretical. Organizations should assume any ConnectWise-managed endpoint population has been exposed to reconnaissance at minimum, and hunt accordingly.
Detection & Response
The detections below focus on the highest-fidelity behavioral signals: ScreenConnect spawning command interpreters or enumeration tooling, anomalous execution velocity consistent with automation, and unauthorized RMM presence. Every rule here was written to fire on attacker behavior, not administrator routine.
Sigma Rules
The first rule targets ScreenConnect processes spawning command shells and discovery tooling — the core execution vector in this campaign. The second targets the velocity signature of AI-automated enumeration: multiple distinct discovery commands from a single parent in a short window is not how humans operate. The third catches unauthorized RMM installation, a common persistence/backup-access move.
---
title: ScreenConnect Spawning Command Shell or Discovery Tooling
id: 3c8f2a71-94bd-4e52-bf17-0a6c2d8e9f31
status: experimental
description: Detects ConnectWise ScreenConnect service processes spawning command interpreters, scripting engines, or reconnaissance utilities. Consistent with Storm-0940 abuse of the ConnectWise management plane for remote execution across tenants.
references:
- https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack
- https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.command_and_control
- attack.t1219
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- '\\ScreenConnect.ClientService.exe'
- '\\ScreenConnect.Service.exe'
- '\\ScreenConnect.WindowsBackstageShell.exe'
selection_child:
Image|endswith:
- '\\cmd.exe'
- '\\powershell.exe'
- '\\pwsh.exe'
- '\\wscript.exe'
- '\\cscript.exe'
- '\\rundll32.exe'
- '\\regsvr32.exe'
- '\\net.exe'
- '\\net1.exe'
- '\\nltest.exe'
- '\\whoami.exe'
- '\\ipconfig.exe'
- '\\systeminfo.exe'
- '\\quser.exe'
- '\\wmic.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate MSP technician activity via ScreenConnect sessions — correlate with authorized session schedules and technician identity before suppressing
level: high
---
title: Rapid Automated Enumeration Burst From RMM Parent Process
id: 8d41c6b2-2f7a-4e93-a5d8-6b1f9c04e2a7
status: experimental
description: Detects bursts of distinct host/network discovery commands spawned by an RMM agent process in short succession. Human operators interleave thinking time; AI-driven automation as reported in the Storm-0940 campaign issues enumeration commands back-to-back.
references:
- https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack
- https://attack.mitre.org/techniques/T1082/
- https://attack.mitre.org/techniques/T1087/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.discovery
- attack.t1082
- attack.t1087
- attack.t1018
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- '\\ScreenConnect'
selection_cmds:
CommandLine|contains:
- 'net user'
- 'net group'
- 'net localgroup'
- 'net view'
- 'nltest /dclist'
- 'nltest /domain_trusts'
- 'whoami /all'
- 'whoami /priv'
- 'whoami /groups'
- 'systeminfo'
- 'ipconfig /all'
- 'arp -a'
- 'route print'
- 'qwinsta'
- 'query user'
condition: selection_parent and selection_cmds
falsepositives:
- MSP onboarding scripts and inventory collection jobs — baseline known automation accounts and suppress by service account, not by command
level: medium
---
title: Unauthorized ScreenConnect Installation or Service Registration
id: 5e29b8d4-61ac-47f0-9c3a-8d2e6f1b7a90
status: experimental
description: Detects installation or service registration of ScreenConnect from non-standard paths or via direct service creation, indicating a rogue or attacker-deployed RMM instance used for persistence or backup access.
references:
- https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack
- https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1543.003
- attack.command_and_control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_sc:
Image|endswith: '\\sc.exe'
CommandLine|contains|all:
- 'create'
selection_sc_name:
CommandLine|contains:
- 'screenconnect'
selection_installer:
CommandLine|contains:
- 'ScreenConnect'
CommandLine|contains:
- '\\AppData\\'
- '\\Temp\\'
- '\\ProgramData\\'
- '\\Users\\Public\\'
condition: (selection_sc and selection_sc_name) or selection_installer
falsepositives:
- Legitimate ScreenConnect client deployment — restrict alerting to paths outside your approved deployment directory
level: high
KQL Hunt (Microsoft Sentinel / Defender)
This query hunts the Storm-0940 execution pattern in Defender for Endpoint: ScreenConnect-spawned shells and discovery tooling, enriched with a per-device execution velocity signal to surface the automation fingerprint. Deploy it as a scheduled analytics rule with entity mapping on Account and Host.
let DiscoveryCommands = dynamic(["net user", "net group", "net localgroup", "net view",
"nltest", "whoami", "systeminfo", "ipconfig /all", "arp -a", "route print",
"qwinsta", "query user", "tasklist", "netstat"]);
let ScreenConnectChildren = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsBackstageShell.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "net1.exe",
"nltest.exe", "whoami.exe", "ipconfig.exe", "systeminfo.exe", "wmic.exe",
"rundll32.exe", "regsvr32.exe", "quser.exe", "arp.exe", "route.exe", "netstat.exe")
| extend IsDiscovery = ProcessCommandLine has_any (DiscoveryCommands)
| project TimeGenerated, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, IsDiscovery, ReportId;
let Velocity = ScreenConnectChildren
| where IsDiscovery
| summarize DiscoveryCmdCount = dcount(ProcessCommandLine),
DistinctTools = dcount(FileName),
FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by DeviceId, bin(TimeGenerated, 10m)
| where DiscoveryCmdCount >= 5
| extend WindowSeconds = datetime_diff("second", LastSeen, FirstSeen);
ScreenConnectChildren
| join kind=leftouter (Velocity) on DeviceId
| extend AutomationSuspected = (DiscoveryCmdCount >= 5 and WindowSeconds <= 300)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessCommandLine, AutomationSuspected, DiscoveryCmdCount, ReportId
| order by AutomationSuspected desc, TimeGenerated desc
For environments ingesting firewall/proxy telemetry, also hunt for ScreenConnect session traffic to operator IPs outside your MSP's documented source ranges — session origin anomalies are often the earliest indicator of management-plane compromise.
Velociraptor VQL
Use this artifact across your fleet to inventory ScreenConnect presence, identify instances running from non-standard paths, and enumerate child process execution — critical for scoping which of the 2,200+ affected tenants' patterns appear in your environment.
-- Inventory ScreenConnect processes, flag non-standard install paths, and enumerate spawned children
LET approved_paths = ("C:/Program Files/ScreenConnect", "C:/Program Files (x86)/ScreenConnect")
LET sc_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)screenconnect'
LET flagged = SELECT *,
(NOT (Exe =~ '(?i)program files')) AS NonStandardPath
FROM sc_procs
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime, NonStandardPath
FROM flagged
ORDER BY NonStandardPath DESC
-- Follow-up: enumerate children of any flagged ScreenConnect PID
-- SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
-- FROM pslist()
-- WHERE Ppid IN (SELECT Pid FROM flagged WHERE NonStandardPath)
Complement this with a netstat sweep for ScreenConnect listener/relay connections (default relay port 8041, web UI 8040) to identify unexpected session endpoints:
-- Identify active ScreenConnect network sessions and remote endpoints
SELECT Pid, Name, Family, Type, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE (Lport IN (8040, 8041) OR Rport IN (8040, 8041))
OR Name =~ '(?i)screenconnect'
Remediation and Audit Script
Run this PowerShell audit on Windows endpoints and management servers to inventory ScreenConnect installations, flag rogue instances, and export service/session evidence for IR scoping. Run elevated.
# Storm-0940 / ConnectWise Supply Chain Compromise - Audit & Scoping Script
# Run as Administrator. Outputs JSON evidence bundle per host for IR triage.
$report = [ordered]@{}
$report.Hostname = $env:COMPUTERNAME
$report.Timestamp = (Get-Date).ToUniversalTime().ToString("o")
# 1. Inventory ScreenConnect services - flag any running outside approved install paths
$approvedRoots = @("C:\Program Files\ScreenConnect", "C:\Program Files (x86)\ScreenConnect")
$services = Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'ScreenConnect' -or $_.PathName -match 'ScreenConnect' }
$report.ScreenConnectServices = $services | ForEach-Object {
$exePath = ($_.PathName -replace '^"|".*$', '')
[pscustomobject]@{
Name = $_.Name
State = $_.State
StartMode = $_.StartMode
PathName = $_.PathName
StartName = $_.StartName
NonStandardPath = -not ($approvedRoots | Where-Object { $exePath -like "$_*" })
}
}
# 2. Flag unauthorized ScreenConnect binaries anywhere on disk (common rogue-install locations)
$searchRoots = @("$env:ProgramData", "$env:PUBLIC", "$env:TEMP", "$env:APPDATA")
$report.RogueBinaries = foreach ($root in $searchRoots) {
Get-ChildItem -Path $root -Recurse -Filter "ScreenConnect*.exe" -ErrorAction SilentlyContinue |
Select-Object FullName, CreationTime, LastWriteTime, @{N='Signer';E={ (Get-AuthenticodeSignature $_.FullName).SignerCertificate.Subject }}
}
# 3. Enumerate ScreenConnect relay/web listeners and active sessions
$report.Listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
Where-Object { $_.LocalPort -in 8040, 8041 } |
Select-Object LocalAddress, LocalPort, OwningProcess
$report.ActiveSessions = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
Where-Object { $_.RemotePort -in 8040, 8041 -or $_.LocalPort -in 8040, 8041 } |
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
# 4. Recent local account creation and privilege changes (common post-compromise moves)
$report.RecentLocalAccounts = Get-LocalUser | Where-Object {
$_.PasswordLastSet -gt (Get-Date).AddDays(-30)
} | Select-Object Name, Enabled, PasswordLastSet, LastLogon
# 5. New services registered in the last 14 days (persistence sweep)
$report.RecentServices = Get-CimInstance Win32_Service | Where-Object {
$_.InstallDate -and ([Management.ManagementDateTimeConverter]::ToDateTime($_.InstallDate)) -gt (Get-Date).AddDays(-14)
} | Select-Object Name, PathName, StartName, State
$outPath = "$env:TEMP\SC_Audit_$($env:COMPUTERNAME)_$(Get-Date -Format 'yyyyMMdd_HHmmss').json"
$report | ConvertTo-Json -Depth 6 | Out-File -FilePath $outPath -Encoding UTF8
Write-Output "[+] Evidence bundle written to $outPath"
# 6. Alert summary to console
if ($report.ScreenConnectServices.NonStandardPath -contains $true -or $report.RogueBinaries) {
Write-Warning "[!] POTENTIAL ROGUE SCREENCONNECT INSTANCE DETECTED - isolate host and escalate to IR immediately"
} else {
Write-Output "[+] No rogue ScreenConnect indicators found on this host"
}
Remediation
Immediate actions (first 24 hours):
- Apply all ConnectWise-issued updates and guidance immediately. Review the official ConnectWise security bulletins at https://www.connectwise.com/company/trust/security-bulletins and Microsoft's Storm-0940 reporting for vendor-specific remediation steps. Do not defer patching on RMM infrastructure — it is your highest-leverage attack surface.
- Rotate credentials across the trust plane. Reset ScreenConnect instance-level credentials, API tokens, integration secrets, and any service accounts the RMM agent operates under. Assume any credential accessible to the management plane was exposed.
- Restrict RMM session sources. Enforce IP allowlisting for operator sessions, require MFA on all technician accounts, and disable any unattended access configurations that are not operationally required and individually justified.
- Hunt before you assume clean. Run the KQL and VQL content above across the full affected lookback window. The AI-automated nature of this campaign means reconnaissance likely touched assets your manual review would skip.
Containment actions if indicators are found:
- Network-isolate affected endpoints immediately; do not rely on the RMM tool itself for response actions on a potentially compromised management plane.
- If you are an MSP tenant and your provider appears on the affected list, demand a formal incident disclosure with scoping detail: which of your endpoints had sessions, from what source IPs, during what window.
- Preserve ScreenConnect session logs, server-side audit logs, and EDR telemetry before any remediation wipes evidence. Session recordings, where enabled, are high-value forensic artifacts.
Structural hardening (next 30 days):
- Remove EDR exclusions on RMM tooling. ScreenConnect exclusions in AV/EDR policies are a documented attacker favorite. Behavioral monitoring of RMM-spawned processes is non-negotiable after this campaign.
- Baseline legitimate RMM behavior. Document approved technician accounts, source IP ranges, session schedules, and typical command patterns. Detection of AI-speed automation is only possible against a known human-speed baseline.
- Contract and visibility review. If you consume MSP services, your contracts must guarantee telemetry access, breach notification SLAs, and the right to independent forensic review of the provider's management plane.
- Application control for unauthorized RMM. Maintain an allowlist of approved remote access tools and alert on any other RMM binary execution — unauthorized ScreenConnect instances are both an attack vector and a shadow-IT risk.
The strategic lesson here is larger than one actor or one vendor. When adversaries automate intrusion operations with AI tooling, defenders who still operate at human tempo lose by default. Compressed detection pipelines, pre-built RMM abuse detections, and rehearsed management-plane compromise playbooks are no longer maturity aspirations — they are baseline requirements.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.