ScreenConnect User Database Modification
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "File Created or Modified" AND (FILENAME endswith ".xml" OR OBJECTNAME endswith ".xml") AND ((FILENAME contains "Temp" AND FILENAME contains "ScreenConnect") OR (OBJECTNAME contains "Temp" AND OBJECTNAME contains "ScreenConnect")) AND PROCESSNAME endswith "\ScreenConnect.Service.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.FILENAME,Action1.PROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress
