sublimehighRule

Link: ScreenConnect remote access tool delivery with unattended guest access

Detects inbound messages containing ScreenConnect links that direct recipients to download a Guest Access installer (.msi or .exe). The links use ScreenConnect's integration parameters specifying Guest session type and Access mode, indicating unsolicited remote access tool deployment. Lures observed include fake invoices, payment proofs, event invitations, and social gathering notifications — often urging recipients to open the link on a Windows desktop and install the downloaded file.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1566 T1598

initial-access

Detection Query

type.inbound
// at least one link to screenconnect
and length(filter(body.links,
                  .href_url.domain.root_domain == "screenconnect.com"
                  // exclude tenant_domains (if the customer users screenconnect and has their own subdomain)
                  and .href_url.domain.domain not in $tenant_domains
           )
) > 0
// all the screenconnect links include an msi/exe with Guesst Access
and all(filter(body.links, .href_url.domain.root_domain == "screenconnect.com"),
        strings.iends_with(.href_url.path, '.msi', '.exe')
        // https://docs.connectwise.com/ScreenConnect_Documentation/Developers/Integration_guide
        // e = SessionType. Support, Meet, or Access
        and strings.icontains(.href_url.query_params, "e=Access")
        // y = ProcessType (host vs guest)
        and strings.icontains(.href_url.query_params, "y=Guest")
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: ScreenConnect remote access tool delivery with unattended guest access"
description: "Detects inbound messages containing ScreenConnect links that direct recipients to download a Guest Access installer (.msi or .exe). The links use ScreenConnect's integration parameters specifying Guest session type and Access mode, indicating unsolicited remote access tool deployment. Lures observed include fake invoices, payment proofs, event invitations, and social gathering notifications — often urging recipients to open the link on a Windows desktop and install the downloaded file."
type: "rule"
severity: "high"
source: |
  type.inbound
  // at least one link to screenconnect
  and length(filter(body.links,
                    .href_url.domain.root_domain == "screenconnect.com"
                    // exclude tenant_domains (if the customer users screenconnect and has their own subdomain)
                    and .href_url.domain.domain not in $tenant_domains
             )
  ) > 0
  // all the screenconnect links include an msi/exe with Guesst Access
  and all(filter(body.links, .href_url.domain.root_domain == "screenconnect.com"),
          strings.iends_with(.href_url.path, '.msi', '.exe')
          // https://docs.connectwise.com/ScreenConnect_Documentation/Developers/Integration_guide
          // e = SessionType. Support, Meet, or Access
          and strings.icontains(.href_url.query_params, "e=Access")
          // y = ProcessType (host vs guest)
          and strings.icontains(.href_url.query_params, "y=Guest")
  )
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Social engineering"
  - "Out of band pivot"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "ed0e62be-7385-522b-ac10-6636b0b2c0de"