sublimehighRule

Link: ScreenConnect installer with suspicious relay domain

Detects when a link leads to a ConnectWise ScreenConnect installer and references a relay domain that doesn't match sender or organizational domains.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1036 T1027 T1566 T1598

defense-evasioninitial-access

Detection Query

type.inbound
and any(body.links,
        strings.ends_with(.href_url.url, ".exe")
        and any(ml.link_analysis(., mode="aggressive").files_downloaded,
                any(file.explode(.),
                    any(.scan.strings.strings,
                        strings.icontains(., "ScreenConnect")
                    )
                    and any(filter(.scan.strings.strings,
                                   strings.icontains(.,
                                                     "h="
                                   ) // relay domain
                                   and strings.icontains(.,
                                                         "k="
                                   ) // encoded encryption key
                            ),
                            any(regex.extract(., 'h=(?P<url>[^&]+)'),
                                strings.parse_url(strings.concat("https://",
                                                                 .named_groups["url"]
                                                  )
                                ).domain.root_domain not in $org_domains
                                and strings.parse_url(strings.concat("https://",
                                                                     .named_groups["url"]
                                                      )
                                ).domain.root_domain != sender.email.domain.root_domain
                            )
                    )
                )
        )
)
and not profile.by_sender_email().any_messages_benign

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: ScreenConnect installer with suspicious relay domain"
description: "Detects when a link leads to a ConnectWise ScreenConnect installer and references a relay domain that doesn't match sender or organizational domains."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(body.links,
          strings.ends_with(.href_url.url, ".exe")
          and any(ml.link_analysis(., mode="aggressive").files_downloaded,
                  any(file.explode(.),
                      any(.scan.strings.strings,
                          strings.icontains(., "ScreenConnect")
                      )
                      and any(filter(.scan.strings.strings,
                                     strings.icontains(.,
                                                       "h="
                                     ) // relay domain
                                     and strings.icontains(.,
                                                           "k="
                                     ) // encoded encryption key
                              ),
                              any(regex.extract(., 'h=(?P<url>[^&]+)'),
                                  strings.parse_url(strings.concat("https://",
                                                                   .named_groups["url"]
                                                    )
                                  ).domain.root_domain not in $org_domains
                                  and strings.parse_url(strings.concat("https://",
                                                                       .named_groups["url"]
                                                        )
                                  ).domain.root_domain != sender.email.domain.root_domain
                              )
                      )
                  )
          )
  )
  and not profile.by_sender_email().any_messages_benign
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
  - "Out of band pivot"
  - "Social engineering"
detection_methods:
  - "URL analysis"
  - "File analysis"
  - "Content analysis"
id: "37d21eef-c45c-5348-b764-a6dc48261a91"