SMOKE#SCREEN — Fake Adobe and Zoom Updates Installing ScreenConnect RMM

The payload is not malware. It is a real, correctly signed ScreenConnect client, and that is the whole point. SMOKE#SCREEN is an active multi-wave campaign disclosed by Securonix Threat Research on 2026-08-04. The operators rotate social-engineering lures across four themes, fake Zoom updates, fake Adobe updates, business document reviews, and system maintenance utilities, and every path ends the same way: a legitimate ConnectWise ScreenConnect MSI, signed with a valid DigiCert-chained Authenticode certificate, silently installed and beaconing to an attacker-controlled relay.

The investigation began from a single VBScript dropper and led to a live WsgiDAV staging server at 207.174.0.143:8080 that was exposing an open directory listing of 15 payload files. The same host doubles as the primary ScreenConnect relay on port 8041, so one machine both delivers the payload and holds command and control over already-compromised endpoints. Two further relay clusters were identified, each with its own RSA key pair, which is deliberate compartmentalisation rather than sloppiness: burning one relay leaves the other two running.

The toolkit spans several runtimes. An XOR-encrypted VBScript dropper with a flattened state machine and sandbox checks represents the actor at their most cautious. A plain 23-line VBScript creates every process through the WMI Win32_Process class with ShowWindow = 0 to avoid the commonly-flagged WScript.Shell path. A batch file named SystemCheck escalates through UAC, patches AMSI in memory, tears down SmartScreen through the registry, adds Defender exclusions, strips the Mark-of-the-Web with Unlock-File, then installs silently. Compiled .NET loaders built from MemoryLoader.cs run a nine-step Defender destruction sequence that completes within 15 seconds, including Add-MpPreference -ExclusionPath 'C:\', which blinds Defender to the entire filesystem permanently until an administrator reverses it by hand.

The tradecraft arc is the most useful thing in this report for a defender. The actor's newest loader, loader.cs, removed the Defender destruction sequence entirely and replaced it with a deliberate 180-second sleep between MSI installation and service start, carrying the source comment // WAIT 3 MINUTES (Breaks Elastic correlation). That is direct evidence of adversary testing against a named commercial EDR, and it tells you two things: the behavioural Defender-tampering detections were working, and correlation windows shorter than a few minutes are now explicitly targeted. Any detection in your estate that joins an installer to its resulting service inside a 60-second window will miss the current build.

The campaign is cross-platform. A macOS package, ZoomUpdateInstaller.pkg, connects to the same primary relay as the Windows MSIs. Securonix did not identify how the Mac installer was distributed and reported no confirmed macOS infections, so the macOS branch ships here as a hunt, not as an incident indicator.

Defender priority: hash and domain blocking will not carry you here. The actor rotates payload hashes between download sessions, and the final binary is a legitimate signed vendor product that many EDR configurations deliberately scrutinise less. Build the detection around unauthorised instance signals instead: a ScreenConnect client talking to a raw IP rather than a ConnectWise relay domain, a ScreenConnect service appearing on a host outside your sanctioned RMM inventory, and msiexec /qn whose parent is a script host or a browser. Sections 8 and 9 are built on exactly those three.

Four sources were fetched and snapshotted verbatim into this pack's source directory. Every atomic indicator shipped in section 10 traces mechanically back to one of those snapshots before publication.

Decisions taken during research

• Dark Reading was dropped from the citation set. The article was reachable in search results but the page itself returned an empty body to automated retrieval. Nothing was cited from it, and no snapshot was kept, because a source that cannot be snapshotted cannot back an indicator.
• Two unrelated campaigns were excluded from The Hacker News article. That page carries a second story, a Bitdefender report on fake Xeno Roblox cheat installers delivering the Powercat Java stealer, with its own separate C2 domain. Automated summarisation merged the two. Those indicators belong to a different campaign and appear nowhere in the Securonix primary, so none of them ship here.
• Cloudflare edge addresses were not shipped. The primary report notes that the Quick Tunnel hostname resolved to Cloudflare IPs during analysis. Those are shared CDN front-ends serving a large share of the public internet, not actor infrastructure.
• Dropbox was not shipped as a domain indicator. The Zoom phishing page delivers its payload through a Dropbox shared link. Blocking dropbox.com to catch this campaign is not a proportionate control. The specific shared-link path fragment is recorded in section 4 as a proxy-log hunt string instead.
• Filenames ship as hunt logic, not as blocklist rows. Several payload names are randomised per build (BuYUEVqG.msi, JqbMljCi.msi, NYbiLtvO.exe, zFbJVuiX.exe, lirMkvpf.exe) and the report states explicitly that the actor rotates payload hashes between download sessions. Their hashes ship; the names drive the shape-matching in Q13 rather than an exact-name block.
• No sanctioned-instance identifier was invented. The primary report documents the ScreenConnect URL parameters e=Access&y=Guest but publishes no attacker instance ID string. Every tuning line that needs your own approved ScreenConnect instance carries a labelled REPLACE_WITH_ placeholder rather than a fabricated value.
• Nothing ships at prevent or critical severity. All public reporting on this campaign traces to a single vendor investigation. The Hacker News, Security Affairs and AppleInsider are derivative coverage of the Securonix research, not independent telemetry, so the two-independent-source bar for a blocking action is not met.
• No prompt-injection attempt was found in any fetched page. No source contained text directing an agent to run a command, fetch a further URL, skip a step, or claiming authorisation.

Relationship to the existing library. The HuntPack library already contains ScreenConnect-AsyncRAT-SEO-Hunt.html, covering an SEO-poisoning campaign that delivers ScreenConnect alongside AsyncRAT. The two share tooling and nothing else: different delivery, different infrastructure, different loader artefacts, no macOS branch. This pack deliberately does not restate generic ScreenConnect coverage and focuses on the SMOKE#SCREEN lure chain, its own staging and relay estate, the VBScript, batch and .NET loader artefacts, and the macOS package.

Attack chain

Hunt hypotheses

Every value below appears verbatim in a saved source snapshot. Severity reflects the single-vendor sourcing described in section 2, so no row is rated for a blocking action.

Infrastructure

Sample hashes (SHA-256)

Behavioural signatures (no atomic value, hunt these instead)

• XOR key gc1HXjFtHBbC659t, a 16-byte key used by the obfuscated VBScript dropper. Useful for retro-hunting sample repositories, not for endpoint telemetry.
• State sequence 185, 626, 616, 518, 442, 509, 821 in the flattened VBScript execution path.
• Sandbox process blacklist: wireshark.exe, procmon.exe, vboxservice.exe, vmtoolsd.exe, xenservice.exe, fiddler.exe, plus an abort if physical memory is under 2 GB.
• Masquerade filename WindowsExplorerSupport.msi used locally in TEMP while the actual download target was SystemCheck.msi.
• ScreenConnect session parameters e=Access&y=Guest, the default ConnectWise guest-access configuration.
• Loader source comment // WAIT 3 MINUTES (Breaks Elastic correlation) with a 180000 ms sleep.
• MSI component set: Client.dll, ClientService.dll, Core.dll, WindowsClient.exe, WindowsCredentialProvider.dll, all signed to Connectwise, LLC through the DigiCert chain.
• In-memory compilation via Add-Type -Language CSharp followed by invocation of a HelloWorld.Program entry point, which is deliberate misdirection.

Techniques as published in the primary report, with the query that covers each.

Checks that do not need Falcon telemetry. Run these in parallel with section 8, because several of them cover steps the endpoint sensor cannot see.

Build the RMM inventory first

This is the prerequisite for half the pack. Every unsanctioned-instance query depends on you knowing which ScreenConnect relays and instance identifiers are legitimately yours. Record the answer before running section 8, or the results are unreadable.

# Windows, per host. Enumerate installed ScreenConnect / ConnectWise services
# and the relay each one is configured to reach.
Get-CimInstance Win32_Service |
  Where-Object { $_.Name -match 'ScreenConnect|ConnectWise' } |
  Select-Object Name, DisplayName, PathName, StartMode, State |
  Format-List

# The relay host is embedded in the service image path and in the client
# configuration. Record every distinct value you find across the fleet.

Web proxy and firewall

• Search proxy logs for the Dropbox shared-link path fragment scl/fi/a0hp9g4w2ddkb3ggnkivx. Dropbox itself is allow-listed in most estates, so the path is the only discriminator.
• Search for any request to a trycloudflare.com subdomain. Quick Tunnels are ephemeral and have almost no legitimate enterprise use. If your developers do use them, enumerate the sanctioned hostnames and alert on everything else.
• Firewall: alert on outbound tcp/8041 to any destination. That is the ScreenConnect relay port and it should only ever reach your own approved relay.
• Firewall: review outbound tcp/8080 from workstations. The staging server runs there, and workstation-initiated 8080 to an external IP is rarely business traffic.

Mail gateway

• Retro-hunt for messages carrying links to the three infrastructure addresses in section 4, and for attachments with a .vbs or .gzip extension delivered to end users.
• Search for lure subject patterns around Zoom updates, Adobe updates, document review requests and system maintenance notices in the period since disclosure. No sender addresses or subject lines were published, so this is a shape hunt rather than an exact match.

Microsoft Defender operational log

• Event ID 5007 records exclusion changes. Any exclusion whose path is a drive root is an incident, not a finding.
• Event ID 5001 records real-time protection being disabled.
• Service Control Manager event ID 7040 records WinDefend start-type changes to Disabled.
• Compare the current exclusion list against your baseline on every host that returned a hit in Q8.

macOS

# Installed package receipts. A Zoom-themed receipt from an unknown authority
# is the macOS branch of this campaign.
pkgutil --pkgs | grep -i -E 'zoom|screenconnect|connectwise'

# Inspect any hit, then list what it wrote to disk.
pkgutil --pkg-info REPLACE_WITH_PACKAGE_ID
pkgutil --files   REPLACE_WITH_PACKAGE_ID

# Launch items pointing at a ScreenConnect client.
ls -la /Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents 2>/dev/null

Time windows are set in the console, not in the query. None of these queries carry an in-query timeframe filter. Set the range in the Falcon search bar. A suggested starting window is noted on each card.

Three queries need your own values before they will work. Q1, Q2 and Q16 compare against your sanctioned ScreenConnect estate, and no public source can supply that. Each carries a labelled REPLACE_WITH_ placeholder. Fill it from the inventory you build in section 7, or the query will return your legitimate RMM alongside the campaign's.

// HUNT: ScreenConnect relay-port egress to an unapproved destination
// MITRE: T1219, T1550 | CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: your own sanctioned ScreenConnect relay reached by IP address
// TUNING: put your approved relay address in the exclusion below before scheduling.
// TUNING: if you have no ScreenConnect deployment at all, delete the exclusion line
// TUNING: entirely and treat every row as an incident.
#event_simpleName=/^NetworkConnectIP4$/
| RemotePort=/^(8040|8041)$/
| RemoteAddressIP4!=/^REPLACE_WITH_SANCTIONED_RELAY_IP$/
| groupBy([ComputerName, RemoteAddressIP4, RemotePort],
    function=[
      count(as=Connections),
      min(@timestamp, as=FirstSeen),
      max(@timestamp, as=LastSeen),
      collect([ContextBaseFileName, UserName], limit=10)
    ], limit=20000)
| sort(FirstSeen, order=desc, limit=500)

// HUNT: ScreenConnect / ConnectWise service creation, foreign instance identifiers
// MITRE: T1543, T1219 | CONF: high  FP: medium  COST: low
// REQUIRES: CreateService
// FALSE POSITIVES: sanctioned RMM deployment, agent upgrades and repairs
// TUNING: exclude your approved instance identifier, which appears inside both the
// TUNING: service name and the display name, e.g.
// TUNING: | ServiceName!=/REPLACE_WITH_APPROVED_INSTANCE_ID/i
// TUNING: then also exclude your software-deployment service account from UserName.
#event_simpleName=/^CreateService$/
| ServiceDisplayName=/(screenconnect|connectwise)/i
| ServiceName!=/REPLACE_WITH_APPROVED_INSTANCE_ID/i
| table([@timestamp, ComputerName, UserName, ServiceName, ServiceDisplayName, ServiceImagePath], limit=2000)

// HUNT: msiexec silent install with a script-host, browser or masquerading parent
// MITRE: T1218.007, T1036 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: SCCM, Intune, Chocolatey, PDQ and other deployment agents that
// FALSE POSITIVES: wrap msiexec in cmd.exe or powershell.exe
// TUNING: exclude your deployment agent by grandparent, not by parent, e.g.
// TUNING: | GrandparentBaseFileName!=/^(ccmexec|intunemanagementextension|pdqdeploy)(\.exe)?$/i
// TUNING: and exclude the deployment service account from UserName.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^msiexec(\.exe)?$/i
| CommandLine=/[\-\/](qn|quiet|qb)/i
| ParentBaseFileName=/^(wscript|cscript|powershell|pwsh|cmd|mshta|rundll32|wmiprvse|chrome|msedge|firefox|iexplore|explorer|adobereader_update|systemcheck|document-viewer|zoomupdateinstaller)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, GrandparentBaseFileName, FileName, CommandLine], limit=2000)

// HUNT: endpoint contact with published SMOKE#SCREEN infrastructure
// MITRE: T1071.001, T1219, T1105 | CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: none expected; treat every row as an investigation
// NOTE: port 8080 on the first address is payload staging, 8041 is the relay.
#event_simpleName=/^NetworkConnectIP4$/
| RemoteAddressIP4=/^(207\.174\.0\.143|142\.202\.191\.225|207\.189\.11\.170)$/
| groupBy([ComputerName, RemoteAddressIP4, RemotePort],
    function=[
      count(as=Connections),
      min(@timestamp, as=FirstSeen),
      max(@timestamp, as=LastSeen),
      collect([ContextBaseFileName, UserName], limit=10)
    ], limit=20000)
| sort(FirstSeen, order=desc, limit=500)

// HUNT: DNS resolution of SMOKE#SCREEN domains and any Cloudflare Quick Tunnel
// MITRE: T1071.001, T1102 | CONF: high  FP: medium  COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: developers exposing local services through trycloudflare.com
// TUNING: the three named domains are unambiguous. If the generic Quick Tunnel
// TUNING: clause is noisy, split it into its own scheduled search scoped to
// TUNING: non-engineering OUs, or allow-list your known tunnel hostnames rather
// TUNING: than dropping the clause, since it is the part that survives rotation.
#event_simpleName=/^DnsRequest$/
| DomainName=/(^blog\.derrspecial-onlinedmin\.live$|^subscription-magnetic-recommended-meat\.trycloudflare\.com$|^crestmarkhq\.com$|\.trycloudflare\.com$)/i
| groupBy([ComputerName, DomainName],
    function=[
      count(as=Lookups),
      min(@timestamp, as=FirstSeen),
      max(@timestamp, as=LastSeen),
      collect([ContextBaseFileName, UserName], limit=10)
    ], limit=20000)
| sort(FirstSeen, order=desc, limit=500)

// HUNT: script host or download utility reaching an external host on tcp/8080
// MITRE: T1105, T1102 | CONF: medium  FP: medium  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: internal app servers, proxies, build agents and test harnesses
// FALSE POSITIVES: that legitimately listen on 8080
// TUNING: exclude RFC1918 destinations first, which removes almost all the noise:
// TUNING: | RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/
// TUNING: then allow-list any external SaaS your estate genuinely reaches on 8080.
#event_simpleName=/^NetworkConnectIP4$/
| RemotePort=/^8080$/
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)/
| ContextBaseFileName=/^(wscript|cscript|powershell|pwsh|cmd|mshta|rundll32|curl|certutil|bitsadmin|cloudflared|regsvr32)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=2000)

// HUNT: search-ms URI and WebDAV redirector artefacts in a command line
// MITRE: T1105, T1566.002, T1204.002 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: organisations that use WebDAV shares or SharePoint mapped drives
// FALSE POSITIVES: legitimately; Explorer saved searches also emit search-ms URIs
// TUNING: exclude your own WebDAV and SharePoint hostnames from CommandLine, then
// TUNING: keep only rows where the UNC host is an IP literal rather than a name,
// TUNING: which is what the SMOKE#SCREEN staging server presented as.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(search\-ms:|DavWWWRoot|@8080|@SSL|WebClient)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=2000)

// HUNT: Defender service teardown and drive-root exclusion
// MITRE: T1562.001 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 with command-line capture
// FALSE POSITIVES: rare. Some AV migration scripts stop WinDefend legitimately;
// FALSE POSITIVES: none of them exclude a drive root.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(Stop\-Service\s+\-Name\s+WinDefend|Set\-Service\s+\-Name\s+WinDefend|Add\-MpPreference\s+\-ExclusionPath|Set\-MpPreference\s+\-DisableRealtimeMonitoring|sc\s+(stop|config)\s+WinDefend)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=2000)

// HUNT: AMSI patching, UAC re-launch, and in-memory C# compilation
// MITRE: T1562.001, T1548.002, T1059.001 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 with command-line capture
// FALSE POSITIVES: internal red teams, security research hosts, and a small number
// FALSE POSITIVES: of legitimate build tools that use Add-Type -Language CSharp
// TUNING: exclude your red-team and security-research asset group by ComputerName.
// TUNING: the Add-Type clause is the softest of the three. If it is noisy in a
// TUNING: developer estate, drop only that clause and keep the AMSI terms.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(amsiInitFailed|AmsiScanBuffer|AmsiUtils|shell\.application.{0,40}runas|Add\-Type\s+\-Language\s+CSharp|HelloWorld\.Program)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=2000)

// HUNT: SmartScreen policy and Explorer Advanced value changes
// MITRE: T1562.001 | CONF: high  FP: medium  COST: low
// REQUIRES: RegGenericValueUpdate
// FALSE POSITIVES: build images, kiosk provisioning and GPO refresh cycles that
// FALSE POSITIVES: legitimately set these values
// TUNING: exclude your imaging and GPO service accounts from UserName, and exclude
// TUNING: your golden-image build hosts by ComputerName. A change on a live user
// TUNING: workstation outside a maintenance window is the row that matters.
#event_simpleName=/^RegGenericValueUpdate$/
| RegValueName=/^(EnableSmartScreen|ShellSmartScreenLevel|SmartScreenEnabled|DisableAntiSpyware|DisableRealtimeMonitoring)$/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue], limit=2000)

// HUNT: Zone.Identifier / Mark-of-the-Web removal before execution
// MITRE: T1553.005, T1070.004 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 with command-line capture
// FALSE POSITIVES: developers running Unblock-File on downloaded PowerShell modules
// FALSE POSITIVES: and archive tools that clear the stream on extraction
// TUNING: keep the rows where the target is an .msi or .exe. Unblocking a .ps1 or
// TUNING: .psm1 is ordinary developer behaviour; unblocking an installer that was
// TUNING: downloaded seconds earlier is not. Exclude your developer OU.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(Unlock\-File|Unblock\-File|Zone\.Identifier)/i
| CommandLine=/\.(msi|exe|gzip|zip)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=2000)

// HUNT: script host or WMI provider spawning an interpreter or installer
// MITRE: T1059.005, T1047, T1564.003 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: legacy VBScript logon scripts, WMI-based management platforms,
// FALSE POSITIVES: and inventory agents that spawn PowerShell through WmiPrvSE
// TUNING: exclude your management platform's grandparent process and its service
// TUNING: account. If logon scripts are noisy, restrict to the hidden-window forms
// TUNING: by adding | CommandLine=/(\-w\s+hidden|\-WindowStyle\s+Hidden|ShowWindow)/i
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(wscript|cscript|wmiprvse)(\.exe)?$/i
| FileName=/^(powershell|pwsh|cmd|msiexec|mshta|rundll32|certutil|bitsadmin|regsvr32)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=2000)

// HUNT: eight-character mixed-case executable launched from a user-writable path
// MITRE: T1036, T1204.002, T1070.004 | CONF: medium  FP: high  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: installer bootstrappers, browser update stubs, unpacked archives
// FALSE POSITIVES: and temporary compiler output all produce random names in TEMP
// TUNING: this is a triage feed, never a direct alert. Rank by fleet rarity first,
// TUNING: then join surviving hosts against Q1, Q3 and Q8. Exclude your software
// TUNING: distribution cache path and your developer build hosts by ComputerName.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\(Users\\Public|AppData\\Local\\Temp|Downloads)\\/i
| FileName=/^[A-Za-z]{8}\.(exe|msi)$/
| groupBy([FileName, ImageFileName],
    function=[
      count(aid, distinct=true, as=DistinctHosts),
      count(as=Executions),
      collect([ComputerName, UserName, ParentBaseFileName], limit=25),
      min(@timestamp, as=FirstSeen)
    ], limit=20000)
| DistinctHosts < 5
| sort(FirstSeen, order=desc, limit=300)

// HUNT: MSI install and ScreenConnect service creation separated by minutes
// MITRE: T1543, T1497, T1218.007 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 and CreateService
// FALSE POSITIVES: genuinely slow installs on loaded hosts, and any sanctioned RMM
// FALSE POSITIVES: deployment that stages the package then starts the service later
// TUNING: exclude your approved instance identifier from ServiceDisplayName and
// TUNING: your deployment service account from UserName. Tighten the lower bound
// TUNING: toward 170 seconds to sit right on the actor's hard-coded 180s sleep.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|CreateService)$/
| CommandLine=/msiexec/i or ServiceDisplayName=/(screenconnect|connectwise)/i
| groupBy([ComputerName],
    function=[
      min(@timestamp, as=FirstEvent),
      max(@timestamp, as=LastEvent),
      count(as=Events),
      collect([FileName, ServiceName, ServiceDisplayName, ServiceImagePath, CommandLine], limit=20)
    ], limit=20000)
| GapSeconds := (LastEvent - FirstEvent) / 1000
| GapSeconds > 120
| GapSeconds < 900
| sort(FirstEvent, order=desc, limit=300)

// HUNT: macOS installer running an update-impersonating package
// MITRE: T1204.002, T1219 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 on macOS sensors
// FALSE POSITIVES: an administrator manually installing a genuine vendor package
// NOTE: Zoom and Adobe both ship in-app updaters. A loose .pkg named after an
// NOTE: update is the anomaly, not the delivery mechanism either vendor uses.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/\.pkg/i
| CommandLine=/(zoomupdateinstaller|zoom.{0,3}update|adobe.{0,3}reader.{0,3}update|screenconnect|connectwise)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=2000)

// HUNT: rare ScreenConnect client install paths across the fleet
// MITRE: T1219, T1550 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: MSP tooling, contractor laptops, pilot deployments and support
// FALSE POSITIVES: sessions initiated by a vendor with a legitimate business reason
// TUNING: once you know your approved install path, exclude it outright with
// TUNING: | ImageFileName!=/REPLACE_WITH_APPROVED_INSTALL_PATH/i
// TUNING: and raise DistinctHosts above your sanctioned instance's install count.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(screenconnect\.clientservice|screenconnect\.windowsclient|connectwisecontrol\.client|windowsclient)(\.exe)?$/i
| groupBy([FileName, ImageFileName],
    function=[
      count(aid, distinct=true, as=DistinctHosts),
      count(as=Executions),
      collect([ComputerName, UserName], limit=25),
      min(@timestamp, as=FirstSeen)
    ], limit=20000)
| DistinctHosts < 10
| sort(FirstSeen, order=desc, limit=300)

// HUNT: published SMOKE#SCREEN sample hashes, retro-hunt
// MITRE: T1204.002, T1105 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 / PeFileWritten
// FALSE POSITIVES: none. Any match is the sample itself.
// NOTE: hashes rotate between download sessions. Run once, then rely on Q1-Q3.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(SHA256HashData, values=[
    "9161a8f7f07741db06b9f9a87b6ec7f277faf2ae3a3a661d6eb09cec4e12b920",
    "35be1b070f06eb313c3cb818c74aa0a9c2d9f39a05621dac4de6cff6067a5d12",
    "31260c37cc442719ac84540f4159dd9d4738575d2ab05e92c751a9b4b5f9b91b",
    "433b61c29aefaa5b55fe78063e6ad8597d3835f36e1242d5402ab23e6dc61194",
    "c8695906dcefc64becb3123fa0a8058278c8c2f9c86130956b6b10d49c1a35dc",
    "60c730addd2a15e4213a1d37f55186686976de73a106317b5a258fe0121cfd5c",
    "dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2",
    "9d9f3fa5aaf6bc91091873bd7ee04f0cc23e8709e4ad20c61d2779ff1a43c4b4",
    "8e87a734daddd95322b3f18f71eb9275219e244aac4f62b8dc6da6e2e91525e9",
    "dd23012b4dc29cf7901185ae4fb2d507e737e9ea4d467846eafd6a86b26486bf",
    "3cd9b7d583442963261f9985128042bf45d25482efcbf903c9248837cb0d744b",
    "01e4cb3c60fa50b2927daa11f25a3c412549680406fc121a3d1870a9a33f5d38",
    "aa84e2ac68f7fc18f4927b89be7b4a7739f2eaf099e489aa0f65c1d3913ce62a",
    "639430a33c0ecdf5a134501788a3a40f065ae4232efc66e1b82eca2b355e0606",
    "5253e66f1f493c4e13539749f1aa86fd0c61e3072900fec29a44ba046a6d97e2"])
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, SHA256HashData], limit=2000)

Three queries are strong enough to promote to a Custom IOA. The rest stay as scheduled hunts because their false-positive profile depends on estate-specific tooling that no rule can guess.

Alert package for the Q3 IOA

Alert body

What fired. A silent Windows Installer execution was observed on HOST-01 with a parent process that does not normally deploy software. In the SMOKE#SCREEN campaign this step installs a genuine, correctly signed ConnectWise ScreenConnect agent, which then beacons to an attacker-controlled relay and hands the operator a full remote desktop session.

Why it matters. The installed package is legitimate signed vendor software, so signature and reputation controls will not stop it and may not even record it as suspicious. The parent process is the discriminator, not the payload.

Triage checklist

1. Confirm the parent process and the full command line. A parent of wscript.exe, cscript.exe, mshta.exe or a browser is an immediate escalation. A parent of cmd.exe or powershell.exe needs the grandparent checked before you decide.
2. Identify the MSI path in the command line. TEMP, Public and Downloads are all consistent with this campaign. Note the filename, then check whether it still exists on disk. The loaders delete the installer after execution.
3. Run Q2 scoped to the host. If a ScreenConnect or ConnectWise service was created within fifteen minutes either side, you have the full chain.
4. Run Q1 scoped to the host. Any tcp/8041 or tcp/8040 egress to an address that is not your relay confirms an active foothold.
5. Run Q8 scoped to the host. Check whether Defender was stopped, disabled, or given a drive-root exclusion. If it was, the host is degraded independently of this alert and needs remediation regardless of the outcome.
6. Check the Defender operational log for event 5007 and confirm the current exclusion list against your baseline.
7. Pull the user's mail for the preceding 24 hours and look for a lure themed on a Zoom or Adobe update, a document review, or a system maintenance notice.
8. If a foreign ScreenConnect instance is confirmed, move to section 14 and network-contain the host before removing the agent, so the operator cannot react to the uninstall.

Pivot queries

• Host-scoped: add | ComputerName=/^HOST-01$/i to Q2, Q4 and Q8 to build the timeline on the affected machine.
• Estate-wide: run Q16 to find every other host carrying a ScreenConnect client from the same install path.
• Infrastructure: run Q4 and Q5 across full retention to establish whether this is a first contact or a long-running foothold.

Twenty-six atomic indicators, each traced back to a saved source snapshot before publication. Nothing ships at prevent or critical severity, see section 2 for why. Copy each block straight into the tool it names.

type,value,action,severity,expiration,description,tags
# SMOKE#SCREEN / ScreenConnect RMM abuse. Source: Securonix Threat Research, 2026-08-04.
# No row ships at prevent/critical: all public reporting traces to one vendor investigation.
# --- Staging and ScreenConnect relay infrastructure ---
ipv4,207.174.0.143,detect,high,2027-02-05,SMOKE#SCREEN WsgiDAV staging (8080) and primary ScreenConnect relay (8041),campaign:SMOKESCREEN
ipv4,142.202.191.225,detect,high,2027-02-05,SMOKE#SCREEN secondary ScreenConnect relay (8041 and 80 fallback),campaign:SMOKESCREEN
ipv4,207.189.11.170,detect,medium,2026-11-05,SMOKE#SCREEN former C# payload host (reported offline),campaign:SMOKESCREEN
domain,blog.derrspecial-onlinedmin.live,detect,high,2027-02-05,SMOKE#SCREEN tertiary ScreenConnect relay (8041),campaign:SMOKESCREEN
domain,subscription-magnetic-recommended-meat.trycloudflare.com,detect,medium,2026-11-05,SMOKE#SCREEN Cloudflare Quick Tunnel for MSI delivery (ephemeral),campaign:SMOKESCREEN
domain,crestmarkhq.com,detect,medium,2026-11-05,SMOKE#SCREEN former MSI hosting behind Cloudflare proxy,campaign:SMOKESCREEN
# --- Initial-access scripts and phishing pages ---
sha256,9161a8f7f07741db06b9f9a87b6ec7f277faf2ae3a3a661d6eb09cec4e12b920,detect,high,2027-02-05,zoom-update.vbs XOR-encrypted VBScript dropper,campaign:SMOKESCREEN
sha256,35be1b070f06eb313c3cb818c74aa0a9c2d9f39a05621dac4de6cff6067a5d12,detect,high,2027-02-05,RSKAdvGrpSupportingdocuments.vbs WMI-based dropper,campaign:SMOKESCREEN
sha256,31260c37cc442719ac84540f4159dd9d4738575d2ab05e92c751a9b4b5f9b91b,detect,high,2027-02-05,SystemCheck security-killing batch loader,campaign:SMOKESCREEN
sha256,873011c181d00709fdf66f32bb3cca0c5ff3147d00ef818fef72987a6773ea66,detect,medium,2027-02-05,zoom-update.html Zoom update phishing page,campaign:SMOKESCREEN
sha256,2423decbfcf820f41bc356547e4e18e61d60c9829421d7121c374dcef88577f7,detect,medium,2027-02-05,index.html Adobe Flash Player phishing page,campaign:SMOKESCREEN
# --- Compiled .NET loaders ---
sha256,433b61c29aefaa5b55fe78063e6ad8597d3835f36e1242d5402ab23e6dc61194,detect,high,2027-02-05,AdobeReader_Update.exe compiled loader,campaign:SMOKESCREEN
sha256,c8695906dcefc64becb3123fa0a8058278c8c2f9c86130956b6b10d49c1a35dc,detect,high,2027-02-05,NYbiLtvO.exe compiled loader (earlier build),campaign:SMOKESCREEN
sha256,60c730addd2a15e4213a1d37f55186686976de73a106317b5a258fe0121cfd5c,detect,high,2027-02-05,SystemCheck.exe compiled loader (primary relay),campaign:SMOKESCREEN
sha256,dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2,detect,high,2027-02-05,Document-Viewer.exe compiled loader (tertiary relay),campaign:SMOKESCREEN
sha256,9d9f3fa5aaf6bc91091873bd7ee04f0cc23e8709e4ad20c61d2779ff1a43c4b4,detect,high,2027-02-05,zFbJVuiX.exe compiled loader.cs with 180s anti-EDR sleep,campaign:SMOKESCREEN
# --- ScreenConnect MSI payloads (legitimately ConnectWise-signed) ---
sha256,8e87a734daddd95322b3f18f71eb9275219e244aac4f62b8dc6da6e2e91525e9,detect,high,2027-02-05,BuYUEVqG.msi ScreenConnect payload (primary relay),campaign:SMOKESCREEN
sha256,dd23012b4dc29cf7901185ae4fb2d507e737e9ea4d467846eafd6a86b26486bf,detect,high,2027-02-05,Zoomupdateinstaller.msi ScreenConnect payload,campaign:SMOKESCREEN
sha256,3cd9b7d583442963261f9985128042bf45d25482efcbf903c9248837cb0d744b,detect,high,2027-02-05,Document-review.msi ScreenConnect payload (secondary relay),campaign:SMOKESCREEN
sha256,01e4cb3c60fa50b2927daa11f25a3c412549680406fc121a3d1870a9a33f5d38,detect,high,2027-02-05,DocumentReview.msi ScreenConnect payload (secondary relay),campaign:SMOKESCREEN
# --- macOS branch ---
sha256,aa84e2ac68f7fc18f4927b89be7b4a7739f2eaf099e489aa0f65c1d3913ce62a,detect,high,2027-02-05,ZoomUpdateInstaller.pkg macOS package (primary relay),campaign:SMOKESCREEN
sha256,639430a33c0ecdf5a134501788a3a40f065ae4232efc66e1b82eca2b355e0606,detect,high,2027-02-05,Zoomupdateinstaller.pkg macOS package variant,campaign:SMOKESCREEN
# --- Attacker toolchain artefacts recovered from the staging server ---
sha256,5253e66f1f493c4e13539749f1aa86fd0c61e3072900fec29a44ba046a6d97e2,detect,medium,2027-02-05,cloudflared.exe tunnel binary on attacker staging server,campaign:SMOKESCREEN
sha256,371166ebd83e8318b49ba71321396524fbca7dc42fe1ca4badda8af794bf5a59,no_action,informational,2027-02-05,MemoryLoader.cs C# loader source (not an endpoint artefact),campaign:SMOKESCREEN
sha256,63c46b3c090a4b1efef146f2f1efc4f93d44f21db21d7825f43e02c3c5c89de6,no_action,informational,2027-02-05,loader.cs successor loader source (not an endpoint artefact),campaign:SMOKESCREEN
sha256,aefac65c42c0c72ed3e08b32774fa1b902f4fd1d53de189d50f38130cc357764,no_action,informational,2027-02-05,system.config staging-server artefact,campaign:SMOKESCREEN
# --- NOT shipped, deliberately ---
# dropbox.com  : payload delivery used a Dropbox shared link. Blocking the domain is
#                disproportionate. Hunt the path fragment scl/fi/a0hp9g4w2ddkb3ggnkivx
#                in proxy logs instead.
# Cloudflare edge IPs : shared CDN front-ends, not actor infrastructure.
# Randomised filenames : BuYUEVqG.msi, JqbMljCi.msi, NYbiLtvO.exe, lirMkvpf.exe,
#                zFbJVuiX.exe rotate per build. Their hashes ship; the shape is hunted
#                by Q13 instead of blocklisting the names.

207.174.0.143
142.202.191.225
207.189.11.170
blog.derrspecial-onlinedmin.live
subscription-magnetic-recommended-meat.trycloudflare.com
crestmarkhq.com

# Egress rules worth more than the list above, because they survive rotation:
#   deny outbound tcp/8041 to any destination except your approved relay
#   deny outbound tcp/8040 to any destination except your approved relay
#   alert on outbound tcp/8080 from any workstation to an external address
#   alert on DNS resolution of any *.trycloudflare.com hostname

9161a8f7f07741db06b9f9a87b6ec7f277faf2ae3a3a661d6eb09cec4e12b920
35be1b070f06eb313c3cb818c74aa0a9c2d9f39a05621dac4de6cff6067a5d12
31260c37cc442719ac84540f4159dd9d4738575d2ab05e92c751a9b4b5f9b91b
873011c181d00709fdf66f32bb3cca0c5ff3147d00ef818fef72987a6773ea66
2423decbfcf820f41bc356547e4e18e61d60c9829421d7121c374dcef88577f7
433b61c29aefaa5b55fe78063e6ad8597d3835f36e1242d5402ab23e6dc61194
c8695906dcefc64becb3123fa0a8058278c8c2f9c86130956b6b10d49c1a35dc
60c730addd2a15e4213a1d37f55186686976de73a106317b5a258fe0121cfd5c
dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2
9d9f3fa5aaf6bc91091873bd7ee04f0cc23e8709e4ad20c61d2779ff1a43c4b4
8e87a734daddd95322b3f18f71eb9275219e244aac4f62b8dc6da6e2e91525e9
dd23012b4dc29cf7901185ae4fb2d507e737e9ea4d467846eafd6a86b26486bf
3cd9b7d583442963261f9985128042bf45d25482efcbf903c9248837cb0d744b
01e4cb3c60fa50b2927daa11f25a3c412549680406fc121a3d1870a9a33f5d38
aa84e2ac68f7fc18f4927b89be7b4a7739f2eaf099e489aa0f65c1d3913ce62a
639430a33c0ecdf5a134501788a3a40f065ae4232efc66e1b82eca2b355e0606
5253e66f1f493c4e13539749f1aa86fd0c61e3072900fec29a44ba046a6d97e2
371166ebd83e8318b49ba71321396524fbca7dc42fe1ca4badda8af794bf5a59
63c46b3c090a4b1efef146f2f1efc4f93d44f21db21d7825f43e02c3c5c89de6
aefac65c42c0c72ed3e08b32774fa1b902f4fd1d53de189d50f38130cc357764

XOR key (VBScript dropper)   : gc1HXjFtHBbC659t
VBScript state sequence      : 185, 626, 616, 518, 442, 509, 821
Sandbox process blacklist    : wireshark.exe, procmon.exe, vboxservice.exe,
                               vmtoolsd.exe, xenservice.exe, fiddler.exe
Sandbox memory floor         : aborts if physical memory is under 2 GB
Masquerade MSI name in TEMP  : WindowsExplorerSupport.msi
ScreenConnect session params : e=Access&y=Guest
Anti-EDR sleep               : 180000 ms between MSI install and service start
Loader source comment        : // WAIT 3 MINUTES (Breaks Elastic correlation)
In-memory C# compilation     : Add-Type -Language CSharp
Misdirection entry point     : [HelloWorld.Program]::SayHello()
Staging URL path convention  : /Bin/
Signed MSI component set     : Client.dll, ClientService.dll, Core.dll,
                               WindowsClient.exe, WindowsCredentialProvider.dll
Signer                       : Connectwise, LLC via the DigiCert chain

Do not blocklist the ScreenConnect binaries or the ConnectWise signing certificate. The payload is genuine, currently supported vendor software with a valid DigiCert-chained Authenticode signature. Blocking the publisher would break every legitimate ConnectWise deployment, including possibly your own support tooling, and the actor would simply switch to another RMM product. The controls in section 12 restrict which instances may run and where they may connect, which is the proportionate answer.

Four gates. No query in section 8 is trusted, and no Custom IOA in section 9 moves past Monitor, until it clears all four.

Promotion rule

A Custom IOA moves from Monitor to Detect only after five consecutive business days with zero unexplained hits. Q1 in particular should sit in Monitor until you are confident the relay allowlist is complete, because a missing entry turns your own RMM into a daily false positive and the rule will be muted within a week.

Field confidence

All field names in section 8 were checked against the Falcon data model before publication. One note for your tenant: RegStringValue in Q10 is populated only when the registry value is a string type. SmartScreen values are frequently DWORDs, so treat that column as advisory and rely on RegValueName and RegObjectName for the match itself.

The controls below are ordered by deployment friction, not by importance. Every one is anchored to a MITRE mitigation and, where a formal benchmark covers the technology, to that benchmark.

Raw configuration for the four highest-leverage controls. Every step states its prerequisites, whether a reboot is required, and how to undo it.

Playbook 1 — Block RMM relay egress (H1, H2)

Prerequisites:   Perimeter firewall change window. Confirmed approved relay address
                 from the section 7 inventory. Do NOT deploy without it, or you will
                 break your own support tooling.
Reboot required: No.
Rollback:        Delete the four rules created below. No residual state.

# 1. Deny the ScreenConnect relay ports outbound, except to your approved relay.
#    Order matters: the permit must sit above the deny.
permit tcp any REPLACE_WITH_SANCTIONED_RELAY_IP eq 8041
deny   tcp any any eq 8041 log
deny   tcp any any eq 8040 log

# 2. Deny the three published campaign addresses on every port, because the
#    secondary relay falls back to tcp/80 where a port rule will not catch it.
deny   ip any host 207.174.0.143 log
deny   ip any host 142.202.191.225 log
deny   ip any host 207.189.11.170 log

# 3. Alert-only rule for workstation-initiated tcp/8080 to external addresses.
#    Start in alert mode. Review for two weeks before considering a deny.
alert  tcp WORKSTATION_SUBNETS any eq 8080 log

Playbook 2 — Block MSI execution from user-writable paths (H5)

Prerequisites:   AppLocker or WDAC already enforcing in at least Audit mode.
                 A pilot ring of 20 to 50 representative endpoints.
                 An inventory of legitimate installers that stage to %TEMP%.
Reboot required: No. The Application Identity service must be running and set to
                 Automatic; if you are enabling it for the first time, that service
                 change does require a restart to take effect reliably.
Rollback:        Remove the rules from the GPO and run gpupdate /force. If you enabled
                 the AppIdentity service as part of this, set it back to Manual and
                 reboot. Endpoints revert on the next policy refresh.

# Step 1. Run in AUDIT mode for two weeks first. This is not optional. Some
#         legitimate vendor installers genuinely stage an MSI into %TEMP%.
Set-AppLockerPolicy -XmlPolicy .\smokescreen-audit.xml -Merge

# Step 2. Review the 8003 and 8006 audit events before enforcing.
Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/MSI and Script' |
  Where-Object { $_.Id -eq 8003 -or $_.Id -eq 8006 } |
  Select-Object TimeCreated, Id, Message | Format-List

# Step 3. Policy rule shape: deny Windows Installer files from user-writable
#         locations, allow them from your distribution point and from
#         %WINDIR%\Installer.
#         Denied paths:
#           %OSDRIVE%\Users\*\AppData\Local\Temp\*
#           %OSDRIVE%\Users\*\Downloads\*
#           %OSDRIVE%\Users\Public\*
#         Allowed paths:
#           %WINDIR%\Installer\*
#           REPLACE_WITH_SOFTWARE_DISTRIBUTION_UNC_PATH\*

# Step 4. Enforce only after the pilot ring is clean for 14 days.
Set-AppLockerPolicy -XmlPolicy .\smokescreen-enforce.xml -Merge

Playbook 3 — Defender tamper protection and exclusion hygiene (H3, H8)

Prerequisites:   Microsoft Defender Antivirus is the active AV, or the equivalent
                 tamper control exists in your third-party EDR. Intune or
                 Configuration Manager for central policy.
Reboot required: No.
Rollback:        Set DisableTamperProtection back to 0 through the same policy channel.
                 Note that tamper protection is deliberately hard to disable locally,
                 which is the point; roll back centrally, not on the endpoint.

# Step 1. Confirm current state across the fleet.
Get-MpComputerStatus | Select-Object IsTamperProtected, AntivirusEnabled,
  RealTimeProtectionEnabled, AMServiceEnabled

# Step 2. Audit existing exclusions. Any drive-root entry is an incident.
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath

# Step 3. Remove a drive-root exclusion if one is found.
Remove-MpPreference -ExclusionPath 'C:\'

# Step 4. Confirm the WinDefend service start type was not tampered with.
Get-Service WinDefend | Select-Object Name, Status, StartType
# Expected: Running / Automatic. If Disabled, restore it:
Set-Service -Name WinDefend -StartupType Automatic
Start-Service -Name WinDefend

# Step 5. Enforce tamper protection centrally (Intune: Endpoint security,
#         Antivirus profile, Windows Security experience, TamperProtection = Enabled).
#         Verify afterwards:
Get-MpComputerStatus | Select-Object IsTamperProtected

Playbook 4 — UAC hardening and Windows Script Host removal (H6, H7)

Prerequisites:   Confirm no remaining VBScript or JScript logon-script dependency
                 before disabling WSH. Query your logon scripts and any legacy
                 line-of-business apps first. This one genuinely breaks things
                 if you skip the check.
Reboot required: No for the UAC values (a sign-out is enough). No for WSH.
Rollback:        Set Enabled back to 1 for WSH. Restore ConsentPromptBehaviorUser to 3
                 and EnableLUA to 1. Both revert on the next GPO refresh if you deploy
                 through policy rather than directly.

# Step 1. UAC: prompt administrators for consent on the secure desktop, and deny
#         elevation requests from standard users outright.
$p = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
Set-ItemProperty -Path $p -Name 'ConsentPromptBehaviorAdmin' -Value 2 -Type DWord
Set-ItemProperty -Path $p -Name 'ConsentPromptBehaviorUser'  -Value 0 -Type DWord
Set-ItemProperty -Path $p -Name 'PromptOnSecureDesktop'      -Value 1 -Type DWord
Set-ItemProperty -Path $p -Name 'EnableLUA'                  -Value 1 -Type DWord

# Step 2. Verify SmartScreen was not disabled by the batch loader.
Get-ItemProperty -Path $p -Name 'EnableSmartScreen' -ErrorAction SilentlyContinue
# Expected: 1. If 0 or absent on a host that hit Q10, treat as compromised.
Set-ItemProperty -Path $p -Name 'EnableSmartScreen' -Value 1 -Type DWord

# Step 3. Disable Windows Script Host, machine-wide and per-user.
#         ONLY after the logon-script dependency check above.
New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings' `
  -Name 'Enabled' -Value 0 -Type DWord

# Step 4. Confirm. A .vbs double-click should now be refused.
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings' -Name Enabled

Contain the network before you touch the agent. The operator has an interactive remote desktop session. If you uninstall the ScreenConnect client while they are connected, they will see it happen and can re-establish access or escalate to destructive action before you finish. Network containment first, always.

Phase 1 — Isolate

1. Network-contain the host through Falcon. This preserves your sensor visibility while cutting the operator's session.
2. Do not power off and do not reboot. The 180-second sleep in the newest loader means a second-stage action may still be pending in memory, and a reboot destroys the evidence of it.
3. Disable the affected user account and revoke active sessions and refresh tokens. Assume any credential typed or cached during the remote session is compromised.
4. Push the section 10 network blocklist to the perimeter immediately, so any other compromised host in the estate loses its relay at the same time.
5. Run Q4 and Q1 estate-wide before proceeding. If more than one host is talking to a relay, treat this as a campaign against your organisation rather than a single victim, and contain all of them in one action.

Phase 2 — Investigate before eradicating

1. Capture the ScreenConnect service configuration and the relay address from the service image path before removing anything. That is your attribution link to one of the three clusters.
2. Collect the ScreenConnect session and event logs from the client installation directory. They record when the operator connected and for how long.
3. Run Q8 and check the Defender exclusion list and WinDefend start type. A host whose Defender was destroyed stays degraded after the RMM agent is gone.
4. Reconstruct the delivery path with Q3, Q12 and Q13 to identify which lure and which loader variant was used. That tells you what else to look for and whether other users received the same message.
5. Search the user's mailbox and the gateway for the originating lure, then sweep for the same message across all recipients.

Phase 3 — Eradicate

1. Stop and delete the foreign ScreenConnect service, then remove its installation directory. Verify no second instance remains, and confirm your sanctioned agent, if any, is untouched.
2. Restore Defender: re-enable the service, set the start type back to Automatic, remove every attacker-added exclusion, and confirm tamper protection is on.
3. Restore SmartScreen and UAC values from playbook 4, then confirm with the verification commands in that playbook.
4. Remove any staged installer still present in TEMP, Public or Downloads, and preserve a copy for analysis first.
5. Reset credentials for the affected user and for any account whose credentials were used or cached on the host during the exposure window.
6. Rebuild is the safer choice where the aggressive loader ran. If Q8 shows Defender was stopped, disabled and given a drive-root exclusion, the host was fully blind for the duration and you cannot prove what else executed. Reimage rather than clean.

Phase 4 — Recover and verify

1. Return the host to the network only after Q1, Q2, Q4 and Q8 all return clean for it.
2. Monitor the host and the user for 14 days at raised sensitivity. This actor re-lures.
3. Deploy the immediate-tier controls in section 12 across the estate, not only the affected host.
4. Complete gate 2 in section 11 if it was not already done. The RMM inventory is what turns this from a one-off cleanup into a durable detection.
5. Re-run the section 7 fleet-wide service inventory after 30 days to confirm no foreign instance has reappeared.

Seventeen queries ship. Eight rate CONF high, nine medium, none low. Nine carry an FP risk of medium or higher and each of those carries its exclusion inside the query card rather than only in the prose. One, Q13, is rated FP high and is explicitly a triage feed to be joined against Q1, Q3 and Q8 rather than alerted on directly.

The dominant risk in this pack is not a missing query, it is gate 2. Q1, Q2 and Q16 are the three detections that survive infrastructure rotation, and all three compare against a sanctioned RMM inventory that only your organisation can supply. If that inventory is not built, those queries return your own legitimate ScreenConnect estate mixed indistinguishably with the attacker's, an analyst mutes them within a week, and the pack degrades to hash and IP matching that the actor already defeats by rotating both. Section 7 opens with the inventory step for that reason.

Second structural gap: the current loader is quieter than the one most of section 8 was built for. The Defender destruction cluster, Q8 through Q10, is the highest-fidelity behavioural detection here and the actor removed exactly that behaviour from their newest build after concluding it was being caught. Q1, Q2, Q3, Q14 and Q16 are the queries that still fire against loader.cs. Weight your deployment accordingly rather than assuming the loud sequence will announce the intrusion.

Source snapshots. The verbatim fetched text of all four cited threat-intelligence sources is stored alongside this pack in SmokeScreen-ScreenConnect-FakeUpdate-Hunt-sources/. Every atomic indicator in section 10 was traced back to those files mechanically before publication. An indicator that could not be traced would have been converted to a behavioural signal or a labelled placeholder rather than shipped.

Generated 2026-08-05 by HuntPack. Defensive use only.