Power BI Phishing Campaign Delivering Rogue ScreenConnect RMM Clients

// HUNT: ScreenConnect client carrying a reported rogue instance ID (Power BI phishing campaign)
// MITRE: T1219
// CONF: high | FP: low | COST: low | REQUIRES: process creation with image path and command line (ProcessRollup2)
// SOURCE: instance IDs 2b302081e9e777d0 and 43773b3da4ccb17b appear in the GBHackers and Cryptika snapshots
// FALSE POSITIVES: none expected; the instance ID is unique to the attacker's ScreenConnect deployment
// TUNING: none expected; treat every hit as an incident
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/(2b302081e9e777d0|43773b3da4ccb17b)/i or CommandLine=/(2b302081e9e777d0|43773b3da4ccb17b)/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.image.path, tgt.process.cmdline

// HUNT: ScreenConnect client carrying a reported rogue instance ID (Power BI phishing campaign)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the instance ID is unique to the attacker's ScreenConnect deployment
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: either reported instance ID in the image path or the command line. matches is case-insensitive, which reproduces the CQL /i intent. The creator is src.process on a Process Creation event.
// REQUIRES: SentinelOne process-creation telemetry with image path and command line
// TUNING: None expected; treat every hit as an incident.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An instance ID that appears only in a file path or a service registry value, and never in a process image path or command line, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.image.path matches '(2b302081e9e777d0|43773b3da4ccb17b)' or tgt.process.cmdline matches '(2b302081e9e777d0|43773b3da4ccb17b)')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FolderPath, ProcessCommandLine
| take 5

// HUNT: ScreenConnect client carrying a reported rogue instance ID (Power BI phishing campaign)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the instance ID is unique to the attacker's ScreenConnect deployment
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: either reported instance ID in the created process path or its command line. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected; treat every hit as an incident.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FolderPath contains "2b302081e9e777d0" or FolderPath contains "43773b3da4ccb17b" or ProcessCommandLine contains "2b302081e9e777d0" or ProcessCommandLine contains "43773b3da4ccb17b"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: host that ran more than one ScreenConnect instance (second-client swap)
// MITRE: T1219, T1070
// CONF: high | FP: medium | COST: medium | REQUIRES: process creation with image path (ProcessRollup2). Instance ID read from the image path, validate the folder naming in your tenant
// FALSE POSITIVES: legitimate helpdesk migration between instances; a technician running a second approved ScreenConnect session
// TUNING: add `| InstanceId!=/^(YOUR_APPROVED_ID_1|YOUR_APPROVED_ID_2)$/i` before the groupBy to drop your own approved instances, then keep hosts with two or more remaining IDs
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^ScreenConnect\.(ClientService|WindowsClient)\.exe$/i
| ImageFileName=/ScreenConnect Client \((?<InstanceId>[0-9a-f]{16})\)/i
| groupBy([aid, ComputerName], function=[count(InstanceId, distinct=true, as=InstanceCount), collect([InstanceId]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| InstanceCount >= 2
| sort(InstanceCount, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.image.path contains 'ScreenConnect Client ('
| limit 5
| columns event.time, agent.uuid, tgt.process.name, tgt.process.image.path

// HUNT: host that ran more than one ScreenConnect instance (second-client swap)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1070
// CONF: high | FP: medium
// FALSE POSITIVES: legitimate helpdesk migration between instances; a technician running a second approved ScreenConnect session
// EQUIVALENCE: approximate-analytic - PowerQuery in this stage cannot extract the instance ID from the path, so the query counts distinct image paths of the ScreenConnect service binary per host. Each instance lives in its own ScreenConnect Client folder, so two paths means two instances. The user-session client binary is not counted.
// REQUIRES: SentinelOne process-creation telemetry with the full image path
// TUNING: Exclude your approved instance folders after a baseline review, then keep hosts with two or more remaining paths.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The instance ID is not extracted, so the output lists distinct paths rather than IDs. Hosts that only ever ran the user-session client binary (windowsclient.exe) are not counted.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.name matches '^ScreenConnect\\.(ClientService)\\.exe$' and tgt.process.image.path contains 'ScreenConnect Client ('
| group process_starts=count(), instance_paths=estimate_distinct(tgt.process.image.path), first_seen=min(event.time), last_seen=max(event.time) by agent.uuid, endpoint.name
| filter instance_paths >= 2
| sort -instance_paths
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| where FolderPath contains "ScreenConnect Client ("
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: host that ran more than one ScreenConnect instance (second-client swap)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219, T1070
// CONF: high | FP: medium
// FALSE POSITIVES: legitimate helpdesk migration between instances; a technician running a second approved ScreenConnect session
// EQUIVALENCE: equivalent-with-schema-assumptions - Same logic: read the 16-character instance ID from the created process path and keep hosts with two or more distinct IDs. dcount is an estimate but is exact at this cardinality.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Add a where InstanceId !in~ filter listing your approved instance IDs before the summarize, then keep hosts with two or more remaining IDs.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An instance that never started a process the sensor observed is not counted.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^ScreenConnect\.(ClientService|WindowsClient)\.exe$"
| extend InstanceId = tolower(extract(@"(?i)ScreenConnect Client \(([0-9a-f]{16})\)", 1, FolderPath))
| where isnotempty(InstanceId)
| summarize InstanceCount = dcount(InstanceId), InstanceIds = make_set(InstanceId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName
| where InstanceCount >= 2
| sort by InstanceCount desc
| take 200

// HUNT: ScreenConnect installer executed (Power BI phishing campaign delivery)
// MITRE: T1204.002, T1219
// CONF: medium | FP: medium | COST: low | REQUIRES: process creation with command line and parent (ProcessRollup2)
// SOURCE: ClientSetup.exe named in the Huntress snapshot, ClientSetup.msi named only in the Cryptika snapshot
// FALSE POSITIVES: helpdesk and MSP technicians installing an approved ScreenConnect client
// TUNING: exclude ParentBaseFileName values belonging to your software-distribution agent and any CommandLine that contains your approved instance host. Prioritise hits where ParentBaseFileName is a browser or explorer.exe and the image sits in a Downloads or Temp folder
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^ScreenConnect\.ClientSetup\.exe$/i or (FileName=/^msiexec\.exe$/i and CommandLine=/ScreenConnect\.ClientSetup\.msi/i)
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline, src.process.name

// HUNT: ScreenConnect installer executed (Power BI phishing campaign delivery)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1219
// CONF: medium | FP: medium
// FALSE POSITIVES: helpdesk and MSP technicians installing an approved ScreenConnect client
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the installer executable by name, or msiexec with the installer package named in its command line. The creator of the new process is src.process on a Process Creation event.
// REQUIRES: SentinelOne process-creation telemetry with command line and creator
// TUNING: Exclude your software-distribution agent as the creator and command lines naming your approved instance host. Prioritise hits created by a browser or explorer.exe from a Downloads or Temp folder.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An installer renamed before it runs is not matched by name.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^ScreenConnect\\.ClientSetup\\.exe$' or (tgt.process.name matches '^msiexec\\.exe$' and tgt.process.cmdline matches 'ScreenConnect\\.ClientSetup\\.msi'))
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: ScreenConnect installer executed (Power BI phishing campaign delivery)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1219
// CONF: medium | FP: medium
// FALSE POSITIVES: helpdesk and MSP technicians installing an approved ScreenConnect client
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the installer executable by name, or msiexec with the installer package named in its command line. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude your software-distribution agent as InitiatingProcessFileName and command lines naming your approved instance host. Prioritise hits initiated by a browser or explorer.exe from a Downloads or Temp folder.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An installer renamed before it runs is not matched by name.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^ScreenConnect\.ClientSetup\.exe$" or (FileName matches regex @"(?i)^msiexec\.exe$" and ProcessCommandLine matches regex @"(?i)ScreenConnect\.ClientSetup\.msi")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: ScreenConnect installer written to disk by a browser or other process
// MITRE: T1204.002, T1105
// CONF: medium | FP: medium | COST: low | REQUIRES: file-written telemetry (PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: helpdesk staff downloading the installer from your own approved instance
// TUNING: exclude the IT support asset group; prioritise hits where ContextBaseFileName is chrome.exe, msedge.exe, firefox.exe or an email client
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| FileName=/^ScreenConnect\.ClientSetup(\s?\(\d+\))?\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, TargetFileName, ContextBaseFileName, SHA256HashData, aid], limit=200)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, tgt.file.path, src.process.name

// HUNT: ScreenConnect installer written to disk by a browser or other process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: helpdesk staff downloading the installer from your own approved instance
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file-name predicate, including the browser duplicate suffix such as (1), on file-creation events. On a File Creation event the acting process is src.process.
// REQUIRES: SentinelOne file-creation telemetry (File Creation)
// TUNING: Exclude the IT support asset group. Prioritise hits written by chrome.exe, msedge.exe, firefox.exe or an email client.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: File Modification and rename events are not queried, so an installer that appears only through a rename is missed.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' and tgt.file.path matches '(^|[\\\\/])ScreenConnect\\.ClientSetup(\\s?\\(\\d+\\))?\\.exe$'
| columns event.time, endpoint.name, src.process.user, tgt.file.path, src.process.name, tgt.file.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName, FolderPath
| take 5

// HUNT: ScreenConnect installer written to disk by a browser or other process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: helpdesk staff downloading the installer from your own approved instance
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file-name predicate, including the browser duplicate suffix, on file-creation and rename events. The writer is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude the IT support device group. Prioritise hits written by chrome.exe, msedge.exe, firefox.exe or an email client.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL reads PE-written sensor events; this reads generic file events, so a file the sensor does not report is missed.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(7d)
| where ActionType in ("FileCreated", "FileRenamed")
| where FileName matches regex @"(?i)^ScreenConnect\.ClientSetup(\s?\(\d+\))?\.exe$"
| project Timestamp, ReportId, DeviceId, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName, FileOriginUrl, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: reported chain artifacts HideUL_x64 / SCAutoFix.ps1 / launcher cmd / SCAutoRepairEvery2Min
// MITRE: T1564, T1059.001, T1059.003, T1053.005
// CONF: high | FP: low | COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// SOURCE: all four names appear in the Huntress snapshot
// FALSE POSITIVES: none expected
// TUNING: none expected; the launcher .cmd name may be randomised per host, so pivot on SCAutoFix.ps1 if it does not match
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^HideUL_x64(\.exe)?$/i or CommandLine=/(HideUL_x64|SCAutoFix\.ps1|LyN03DvVjUKPrun|SCAutoRepairEvery2Min)/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: reported chain artifacts HideUL_x64 / SCAutoFix.ps1 / launcher cmd / SCAutoRepairEvery2Min
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1564, T1059.001, T1059.003, T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the reported hider binary by name, or any of the four reported artifact names in the command line. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with command line
// TUNING: None expected; the launcher name may be randomised per host, so pivot on SCAutoFix.ps1 if it does not match.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launcher script that never appears in a command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^HideUL_x64(\\.exe)?$' or tgt.process.cmdline matches '(HideUL_x64|SCAutoFix\\.ps1|LyN03DvVjUKPrun|SCAutoRepairEvery2Min)')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: reported chain artifacts HideUL_x64 / SCAutoFix.ps1 / launcher cmd / SCAutoRepairEvery2Min
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1564, T1059.001, T1059.003, T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the reported hider binary by name, or any of the four reported artifact names in the command line. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected; the launcher name may be randomised per host, so pivot on SCAutoFix.ps1 if it does not match.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launcher script that never appears in a command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^HideUL_x64(\.exe)?$" or ProcessCommandLine matches regex @"(?i)(HideUL_x64|SCAutoFix\.ps1|LyN03DvVjUKPrun|SCAutoRepairEvery2Min)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: cmd / PowerShell / msiexec scripting a ScreenConnect install or removal (second-client swap)
// MITRE: T1059.001, T1059.003, T1105, T1070
// CONF: medium | FP: medium | COST: low | REQUIRES: process creation with command line and parent (ProcessRollup2)
// SOURCE: Cryptika snapshot describes command files running PowerShell from temporary directories, downloading secondary installers and removing the first client
// FALSE POSITIVES: sanctioned RMM deployment or cleanup scripts
// TUNING: exclude ParentBaseFileName values of your deployment agent and command lines containing your approved instance host; prioritise hits where the script path is under a Temp or AppData folder
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(cmd|powershell|pwsh|msiexec)\.exe$/i
| CommandLine=/ScreenConnect/i
| CommandLine=/(\.cmd|\.ps1|downloadfile|downloadstring|invoke-webrequest|iwr\s|start-bitstransfer|uninstall|win32_product|remove-item)/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: cmd / PowerShell / msiexec scripting a ScreenConnect install or removal (second-client swap)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1059.003, T1105, T1070
// CONF: medium | FP: medium
// FALSE POSITIVES: sanctioned RMM deployment or cleanup scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same three-stage process-creation predicate: a shell or installer binary, ScreenConnect named in the command line, and a script, download or removal token in the same command line. matches and contains are case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with command line and creator
// TUNING: Exclude your deployment agent as the creator and command lines naming your approved instance host. Prioritise hits where the script path is under a Temp or AppData folder.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script that reaches ScreenConnect through a variable and never names it in the command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.name matches '^(cmd|powershell|pwsh|msiexec)\\.exe$' and tgt.process.cmdline contains 'ScreenConnect' and tgt.process.cmdline matches '(\\.cmd|\\.ps1|downloadfile|downloadstring|invoke-webrequest|iwr\\s|start-bitstransfer|uninstall|win32_product|remove-item)'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: cmd / PowerShell / msiexec scripting a ScreenConnect install or removal (second-client swap)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.001, T1059.003, T1105, T1070
// CONF: medium | FP: medium
// FALSE POSITIVES: sanctioned RMM deployment or cleanup scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same three-stage process-creation predicate: a shell or installer binary, ScreenConnect named in the command line, and a script, download or removal token in the same command line. The (?i) prefix and contains reproduce the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude your deployment agent as InitiatingProcessFileName and command lines naming your approved instance host. Prioritise hits where the script path is under a Temp or AppData folder.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script that reaches ScreenConnect through a variable and never names it in the command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^(cmd|powershell|pwsh|msiexec)\.exe$"
| where ProcessCommandLine contains "ScreenConnect"
| where ProcessCommandLine matches regex @"(?i)(\.cmd|\.ps1|downloadfile|downloadstring|invoke-webrequest|iwr\s|start-bitstransfer|uninstall|win32_product|remove-item)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: scheduled task SCAutoRepairEvery2Min or a two-minute task tied to ScreenConnect
// MITRE: T1053.005
// CONF: high | FP: medium | COST: low | REQUIRES: ScheduledTaskRegistered (⚠ validate in tenant), ProcessRollup2
// SOURCE: task name SCAutoRepairEvery2Min and SCAutoFix.ps1 appear in the Huntress snapshot
// FALSE POSITIVES: the generic branch can match an admin-created repeating task that mentions an approved ScreenConnect path
// TUNING: for the generic branch exclude CommandLine values containing your approved instance host or deployment script path
#event_simpleName=/^(ScheduledTaskRegistered|ProcessRollup2|SyntheticProcessRollup2)$/
| TaskName=/SCAutoRepairEvery2Min/i or CommandLine=/(SCAutoRepairEvery2Min|SCAutoFix\.ps1)/i or (FileName=/^schtasks\.exe$/i and CommandLine=/ScreenConnect/i and CommandLine=/[^a-z]sc\s+minute/i and CommandLine=/[^a-z]mo\s+2(\s|$)/i)
| table([@timestamp, ComputerName, UserName, FileName, TaskName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: scheduled task SCAutoRepairEvery2Min or a two-minute task tied to ScreenConnect
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005
// CONF: high | FP: medium
// FALSE POSITIVES: the generic branch can match an admin-created repeating task that mentions an approved ScreenConnect path
// EQUIVALENCE: telemetry-gap - Partial pivot on process creation only: the reported task name or script in a command line, or schtasks creating a two-minute task that names ScreenConnect. The CQL also reads a scheduled-task registration event, which has no attested SentinelOne equivalent here.
// REQUIRES: SentinelOne process-creation telemetry with command line
// TUNING: For the generic branch exclude command lines containing your approved instance host or deployment script path.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The scheduled-task registration branch of the CQL (a task name field on a registration event) is not covered. A task created through an API or a task XML import, rather than a schtasks command line, is missed.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.cmdline matches '(SCAutoRepairEvery2Min|SCAutoFix\\.ps1)' or (tgt.process.name matches '^schtasks\\.exe$' and tgt.process.cmdline contains 'ScreenConnect' and tgt.process.cmdline matches '[^a-z]sc\\s+minute' and tgt.process.cmdline matches '[^a-z]mo\\s+2(\\s|$)'))
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: scheduled task SCAutoRepairEvery2Min or a two-minute task tied to ScreenConnect
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005
// CONF: high | FP: medium
// FALSE POSITIVES: the generic branch can match an admin-created repeating task that mentions an approved ScreenConnect path
// EQUIVALENCE: telemetry-gap - Partial pivot on process creation only: the reported task name or script in a command line, or schtasks creating a two-minute task that names ScreenConnect. The CQL also reads a scheduled-task registration event, which is a separate Defender table action and is left out.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: For the generic branch exclude command lines containing your approved instance host or deployment script path.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The scheduled-task registration branch of the CQL (a task name field on a registration event) is not covered. A task created through an API or a task XML import, rather than a schtasks command line, is missed.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(SCAutoRepairEvery2Min|SCAutoFix\.ps1)" or (FileName matches regex @"(?i)^schtasks\.exe$" and ProcessCommandLine contains "ScreenConnect" and ProcessCommandLine matches regex @"(?i)[^a-z]sc\s+minute" and ProcessCommandLine matches regex @"(?i)[^a-z]mo\s+2(\s|$)")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: reported campaign domain sweep (staging, second-stage RMM, attacker ScreenConnect instances, decoy)
// MITRE: T1071.001, T1219, T1583.001
// CONF: high | FP: low | COST: medium | REQUIRES: DNS lookup with requesting process (DnsRequest)
// SOURCE: hosts from the Huntress, GBHackers, Cyberpress and Cryptika snapshots (the decoy host is in the three press snapshots only)
// FALSE POSITIVES: none expected; a user investigating the campaign may resolve the domains deliberately
// TUNING: none expected; treat a hit on a staging domain as an executed lure and check Q3 and Q4 on the same aid
#event_simpleName=DnsRequest
| DomainName=/^(hamham27|instance-g01s1n-relay)\.screenconnect\.com$/i or DomainName=/(^|\.)(onthegotree|dailylifeproject|burnsworth|essaywritingservice|openpediatrics)\.site$/i or DomainName=/^check\.vykyn\.click$/i
| groupBy([ComputerName, aid, DomainName, ContextBaseFileName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(LastSeen, order=desc, limit=200)

event.category = 'dns' event.dns.request = *
| limit 5
| columns event.time, event.dns.request, src.process.name

// HUNT: reported campaign domain sweep (staging, second-stage RMM, attacker ScreenConnect instances, decoy)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1219, T1583.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected; a user investigating the campaign may resolve the domains deliberately
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: the three reported domain patterns, grouped per host, domain and requesting process with a count and first and last seen. The requesting process is src.process on a DNS Resolved event.
// REQUIRES: SentinelOne DNS telemetry with the requesting process (DNS Resolved)
// TUNING: None expected; treat a hit on a staging domain as an executed lure and check the installer cards on the same host.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup the sensor does not report, such as DNS over HTTPS inside a browser, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' and (event.dns.request matches '^(hamham27|instance-g01s1n-relay)\\.screenconnect\\.com$' or event.dns.request matches '(^|\\.)(onthegotree|dailylifeproject|burnsworth|essaywritingservice|openpediatrics)\\.site$' or event.dns.request matches '^check\\.vykyn\\.click$')
| group lookups=count(), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, agent.uuid, event.dns.request, src.process.name
| sort -last_seen
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: reported campaign domain sweep (staging, second-stage RMM, attacker ScreenConnect instances, decoy)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1219, T1583.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected; a user investigating the campaign may resolve the domains deliberately
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate on the endpoint DNS action in DeviceEvents: the three reported domain patterns, grouped per device, domain and requesting process. The name is read from AdditionalFields.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: None expected; treat a hit on a staging domain as an executed lure and check the installer cards on the same device.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup the sensor does not report, such as DNS over HTTPS inside a browser, is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend DomainName = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| where DomainName matches regex @"(?i)^(hamham27|instance-g01s1n-relay)\.screenconnect\.com$" or DomainName matches regex @"(?i)(^|\.)(onthegotree|dailylifeproject|burnsworth|essaywritingservice|openpediatrics)\.site$" or DomainName matches regex @"(?i)^check\.vykyn\.click$"
| summarize Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, DeviceId, DomainName, InitiatingProcessFileName
| sort by LastSeen desc
| take 200

// HUNT: ScreenConnect client resolving a relay outside screenconnect.com (second client on separate infrastructure)
// MITRE: T1219, T1071.001
// CONF: medium | FP: medium | COST: medium | REQUIRES: DnsRequest with ContextBaseFileName populated (⚠ validate in tenant)
// SOURCE: Cyberpress and GBHackers snapshots tie the second client to the second-stage domain
// FALSE POSITIVES: your own self-hosted ScreenConnect relay; clients resolving certificate or time services
// TUNING: exclude your self-hosted relay domain with `| DomainName!=/(^|\.)YOUR_RELAY_DOMAIN$/i`; ignore well-known Microsoft and certificate hostnames after baselining
#event_simpleName=DnsRequest
| ContextBaseFileName=/^ScreenConnect\.(ClientService|WindowsClient)\.exe$/i
| DomainName!=/(^|\.)screenconnect\.com$/i
| groupBy([DomainName], function=[count(aid, distinct=true, as=Hosts), count(as=Lookups), collect([ComputerName]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(Hosts, order=desc, limit=200)

event.category = 'dns' event.dns.request = *
| limit 5
| columns event.time, event.dns.request, src.process.name

// HUNT: ScreenConnect client resolving a relay outside screenconnect.com (second client on separate infrastructure)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: your own self-hosted ScreenConnect relay; clients resolving certificate or time services
// EQUIVALENCE: approximate-analytic - Same DNS predicate and grouping per resolved name, but PowerQuery here has no list-collect aggregate, so one sample host is shown in place of the full host list.
// REQUIRES: SentinelOne DNS telemetry with the requesting process (DNS Resolved)
// TUNING: Exclude your self-hosted relay domain and ignore well-known Microsoft and certificate hostnames after baselining.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Only one sample host is shown per resolved name, not the full host list the CQL collects.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' and src.process.name matches '^ScreenConnect\\.(ClientService|WindowsClient)\\.exe$' and event.dns.request = * and !(event.dns.request matches '(^|\\.)screenconnect\\.com$')
| group hosts=estimate_distinct(agent.uuid), lookups=count(), sample_host=any(endpoint.name), first_seen=min(event.time), last_seen=max(event.time) by event.dns.request
| sort -hosts
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, InitiatingProcessFileName, AdditionalFields
| take 5

// HUNT: ScreenConnect client resolving a relay outside screenconnect.com (second client on separate infrastructure)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: your own self-hosted ScreenConnect relay; clients resolving certificate or time services
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate and grouping per resolved name on the endpoint DNS action in DeviceEvents; the requesting process is InitiatingProcessFileName and the name is read from AdditionalFields.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Exclude your self-hosted relay domain and ignore well-known Microsoft and certificate hostnames after baselining.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup the sensor does not report, such as DNS over HTTPS inside a browser, is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName matches regex @"(?i)^ScreenConnect\.(ClientService|WindowsClient)\.exe$"
| extend DomainName = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| where isnotempty(DomainName)
| where not(DomainName matches regex @"(?i)(^|\.)screenconnect\.com$")
| summarize Hosts = dcount(DeviceId), Lookups = count(), DeviceNames = make_set(DeviceName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DomainName
| sort by Hosts desc
| take 200

// HUNT: reported ScreenConnect client SHA256 sweep (legitimate vendor binary, detect only)
// MITRE: T1219
// CONF: high | FP: low | COST: low | REQUIRES: SHA256HashData on process and file-written events
// SOURCE: both hashes appear in the Huntress, Cyberpress and Cryptika snapshots (first client and second client)
// FALSE POSITIVES: none expected for these exact hashes
// TUNING: none expected; never convert this to a block, the binary is a legitimate product
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(field=SHA256HashData, values=["5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3", "f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35"])
| table([@timestamp, ComputerName, UserName, #event_simpleName, FileName, ImageFileName, CommandLine, SHA256HashData, aid], limit=200)

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.time, tgt.process.image.sha256, tgt.file.sha256

// HUNT: reported ScreenConnect client SHA256 sweep (legitimate vendor binary, detect only)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these exact hashes
// EQUIVALENCE: equivalent-with-schema-assumptions - Same hash predicate on both populations the CQL reads: a created process image and a created file. in:anycase reproduces the hash comparison without depending on letter case.
// REQUIRES: SentinelOne process-creation and file-creation telemetry with SHA256 populated
// TUNING: None expected; never convert this to a block, the binary is a legitimate product.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A copy of the client rebuilt with a different configuration has a different hash and is not matched.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' and tgt.process.image.sha256 in:anycase ('5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3', 'f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35')) or (event.type = 'File Creation' and tgt.file.sha256 in:anycase ('5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3', 'f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35'))
| columns event.time, endpoint.name, src.process.user, event.type, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, SHA256
| take 5

// HUNT: reported ScreenConnect client SHA256 sweep (legitimate vendor binary, detect only)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these exact hashes
// EQUIVALENCE: telemetry-gap - Partial pivot on process creation only. The CQL also reads file-written events, which are a separate Defender table and are left out. SHA256 is often unpopulated in this table, and the CQL carries no SHA1 to pivot on.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) with SHA256 populated
// TUNING: None expected; never convert this to a block, the binary is a legitimate product.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The file-written half of the CQL is not covered; run the same hashes against the file events table to cover it. A tenant where SHA256 is unpopulated returns nothing from this query.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where SHA256 in~ ("5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3", "f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256
| sort by Timestamp desc
| take 200