Operation SilentCanvas — JPEG-Staged PowerShell → Trojanized ScreenConnect

Looks for: PowerShell command lines referencing an image file with read/Base64/Get-Content (the fake-JPEG stager). Accomplishes: the first fileless tell. FP: low — legit scripts rarely Get-Content a .jpeg as code.

// HUNT: PowerShell reading a fake-image payload (sysupdate.jpeg)
// MITRE: T1027.003, T1059.001 | CONF: high  FP: low-med  COST: low
// FP NOTES: legit scripts rarely Get-Content/Base64-decode a .jpeg as executable
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(powershell|pwsh)\.exe$/i
| CommandLine=/\.(jpe?g|png|bmp|gif)\b/i
| CommandLine=/(Get-Content|ReadAllBytes|FromBase64|IEX|Invoke-Expression|\[byte\[\]\])/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine], limit=200)

Looks for: the in-box C# compiler (csc.exe) spawned by PowerShell/cmd (compile-after-delivery). Accomplishes: the on-host launcher build. FP: low-med — some dev/.NET tooling; flag PowerShell parent + temp output.

// HUNT: PowerShell-driven csc.exe launcher compile
// MITRE: T1027.004, T1059.001 | CONF: med-high  FP: low-med  COST: low
// TUNING: flag csc.exe with a PowerShell/cmd parent writing to a temp path
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^csc\.exe$/i
| ParentBaseFileName=/^(powershell|pwsh|cmd)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: ComputerDefaults.exe spawning a child, or the registry hijack it abuses (ms-settings\\shell\\open\\command). Accomplishes: the fileless UAC bypass. FP: low — ComputerDefaults rarely launches anything.

// HUNT: ComputerDefaults.exe fileless UAC bypass
// MITRE: T1548.002 | CONF: high  FP: low  COST: low
// FP NOTES: ComputerDefaults spawning a child / ms-settings command hijack is high-signal
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|AsepValueUpdate|RegGenericValueUpdate/
| (ParentBaseFileName=/^ComputerDefaults\.exe$/i
   or RegObjectName=/\\ms-settings\\[Ss]hell\\[Oo]pen\\command/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, RegObjectName, RegStringValue], limit=200)

Looks for: a ScreenConnect client process/service named OneDriveServers or installed from a non-standard path. Accomplishes: the RMM persistence. FP: low-med — allow-list sanctioned RMM relays/instances.

// HUNT: trojanized ScreenConnect service masquerade (OneDriveServers)
// MITRE: T1543.003, T1219 | CONF: med-high  FP: low-med  COST: low
// TUNING: allow-list sanctioned ScreenConnect instances/relays; flag odd names/paths
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|ServiceImagePath|ServiceStarted/
| (FileName=/^(ScreenConnect\.ClientService|ScreenConnect\.WindowsClient)\.exe$/i
   or ServiceName=/OneDriveServers/i
   or CommandLine=/ScreenConnect.+(theworkpc\.com|OneDriveServers)/i)
| table([@timestamp, ComputerName, UserName, FileName, ServiceName, CommandLine], limit=200)

Looks for: DNS for theworkpc.com or connections on the C2 ports 5443/8041. Accomplishes: confirms beaconing. FP: low for the domain; the ports alone are higher-FP — pair with process context.

// HUNT: SilentCanvas C2 (legitserver.theworkpc.com / 5443 / 8041)
// MITRE: T1071, T1219 | CONF: high  FP: low  COST: low
// TUNING: domain is high-fidelity; the bare ports are higher-FP -- add process context
#event_simpleName=/DnsRequest|NetworkConnectIP4/
| (DomainName=/(^|\.)theworkpc\.com$/i or RemotePort=5443 or RemotePort=8041)
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName, RemoteAddressIP4, RemotePort], limit=200)

Looks for: creation of sysupdate.jpeg (or similar decoy image names) in user/temp paths. Accomplishes: catches the stager on disk. FP: low — combine with Q1 for the read-as-code confirmation.

// HUNT: sysupdate.jpeg (decoy image) staged to disk
// MITRE: T1027.003 | CONF: med-high  FP: low  COST: low
// TUNING: combine with Q1 (read-as-code); decoy name may rotate
// NOTE: Falcon standard coverage for non-PE file writes is limited; PeFileWritten fires only
// if the payload is a PE disguised as .jpeg; NewExecutableWritten covers renamed executables.
#event_simpleName=/NewExecutableWritten|PeFileWritten/
| TargetFileName=/\\sysupdate\.jpe?g$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)