Plan
archived
ScreenConnect RMM Tool Abused as Attack Vector
- Engineer — Learn: No patch or configuration change required; this is a technique highlight showing attackers deploy legitimate RMM clients to blend in. Worth auditing your estate for unauthorized ScreenConnect installations and confirming it appears only where IT-sanctioned.
- SOC/IR — Plan: Build or tune detections for ScreenConnect client processes spawning in unexpected contexts (non-IT endpoints, unusual parent processes, new installs outside change windows); review your SIEM for ScreenConnect relay connections to external infrastructure.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.