ScreenConnect User Database Modification

Description

Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.

Query · sigma

selection:
  TargetFilename|endswith: .xml
  TargetFilename|contains|all:
  - Temp
  - ScreenConnect
  Image|endswith: \ScreenConnect.Service.exe
condition: selection

Known false positives

  • This will occur legitimately as well and will result in some benign activity.
Raw source ScreenConnect User Database Modification · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: ScreenConnect User Database Modification
id: 1a821580-588b-4323-9422-660f7e131020
related:
    - id: 4109cb6a-a4af-438a-9f0c-056abba41c6f
      type: similar
status: test
description: |
    Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server.
    This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.
references:
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
    - https://www.cve.org/CVERecord?id=CVE-2024-1709
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
author: Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress
date: 2024-02-21
tags:
    - attack.persistence
    - cve.2024-1709
    - detection.emerging-threats
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '.xml'
        TargetFilename|contains|all:
            - 'Temp'
            - 'ScreenConnect'
        Image|endswith: '\ScreenConnect.Service.exe'
    condition: selection
falsepositives:
    - This will occur legitimately as well and will result in some benign activity.
level: medium

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.