Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/ScreenConnect Remote Access

Created July 14, 2021 12:34
Show Gist options
  • Save Shivammalaviya/3005a9f3b36e367eabc31655c0de1aeb to your computer and use it in GitHub Desktop.
Save Shivammalaviya/3005a9f3b36e367eabc31655c0de1aeb to your computer and use it in GitHub Desktop.
Download ZIP
REvil threat actors typically utilize Cobalt Strike BEACON to establish their presence within an environment. In several instances we observed, they used the remote connection software ScreenConnect.
Raw
ScreenConnect Remote Access
SecurityEvent
| where EventID == 4688
| where (CommandLine contains 'e=Access&' and CommandLine contains 'y=Guest&' and CommandLine contains '&p=' and CommandLine contains '&c=' and CommandLine contains '&k=')
| project TimeGenerated, Account, CommandLine,NewProcessName,Process,SubjectUserName
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment