Hide Navigation Hide TOC

Remote Access Tool - ScreenConnect Server Web Shell Execution (b19146a3-25d4-41b4-928b-1e2a92641b1b)

Detects potential web shell execution from the ScreenConnect server process.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Exploit Public-Facing Application - T1190 (3f886f2a-874f-4333-b794-aa6075009b1c)	Attack Pattern	Remote Access Tool - ScreenConnect Server Web Shell Execution (b19146a3-25d4-41b4-928b-1e2a92641b1b)	Sigma-Rules	1