Sigma Rule Library

ScreenConnect User Database Modification

Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.

View on GitHubOpen raw file

Detection logic

selection

TargetFilename|endswith: .xml
TargetFilename|contains|all:
  - Temp
  - ScreenConnect
Image|endswith: \ScreenConnect.Service.exe

Condition

selection

Raw YAML

title: ScreenConnect User Database Modification
id: 1a821580-588b-4323-9422-660f7e131020
related:
    - id: 4109cb6a-a4af-438a-9f0c-056abba41c6f
      type: similar
status: test
description: |
    Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server.
    This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.
references:
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
    - https://www.cve.org/CVERecord?id=CVE-2024-1709
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
author: Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress
date: 2024-02-21
tags:
    - attack.persistence
    - cve.2024-1709
    - detection.emerging-threats
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '.xml'
        TargetFilename|contains|all:
            - 'Temp'
            - 'ScreenConnect'
        Image|endswith: '\ScreenConnect.Service.exe'
    condition: selection
falsepositives:
    - This will occur legitimately as well and will result in some benign activity.
level: medium

False positives

  • This will occur legitimately as well and will result in some benign activity.

References

Related rules

Similar rules

CVE-2024-1708 - ScreenConnect Path Traversal Exploitation

medium

windows · Same logsource category (file_event)

Moriya Rootkit File Created

critical

windows · Same logsource category (file_event)

Pingback Backdoor File Indicators

high

windows · Same logsource category (file_event)

Potential COLDSTEEL Persistence Service DLL Creation

high

windows · Same logsource category (file_event)