ScreenConnect User Database Modification - Security
This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Definition
Requirements: SACLs must be enabled for the ScreenConnect directory
detection:
selection:
EventID: 4663
ObjectType: 'File'
AccessMask: '0x6'
ObjectName|endswith: '.xml'
ObjectName|contains|all:
- 'Temp'
- 'ScreenConnect'
ProcessName|contains: 'ScreenConnect.Service.exe'
condition: selectionThis will occur legitimately as well and will result in some benign activity.
Tactics
Other