Rule Library

Sigma Rules

1 rule found for "Jason Rathbun (Blackpoint Cyber)"

3,707Total

3,116Detection

451Emerging

137Hunting

Filters

Type

Severity

Status

Product

Category

Detectionhightest

Remote Access Tool - ScreenConnect Server Web Shell Execution

Detects potential web shell execution from the ScreenConnect server process.

WindowsProcess Creation

TA0001 · Initial AccessT1190 · Exploit Public-Facing Application

Jason Rathbun (Blackpoint Cyber)Mon Feb 26windows