Techniques
Sample rules
Remote Access Tool - ScreenConnect Installation Execution
- source: sigma
- technicques:
- t1133
Description
Detects ScreenConnect program starts that establish a remote access to a system.
Detection logic
condition: selection
selection:
CommandLine|contains|all:
- e=Access&
- y=Guest&
- '&p='
- '&c='
- '&k='