ScreenConnect User Database Modification
Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Events for file system activity including creation, modification, and deletion.
detection:
selection:
TargetFilename|endswith: '.xml'
TargetFilename|contains|all:
- 'Temp'
- 'ScreenConnect'
Image|endswith: '\ScreenConnect.Service.exe'
condition: selectionThis will occur legitimately as well and will result in some benign activity.
Tactics
Other