RMM
ScreenConnect
ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Ali Alwashali, Nasreddine Bencherchali
- Created
- 2023-10-01
- Last modified
- 2026-10-09
- Privileges
- Not recorded
- Free / availability
- 14-Days Free Trial
- Verification required
- Not recorded
- Supported platforms
Android
Linux
Windows
iOS
macOS
Capabilities
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
C:\Program Files (x86)\ScreenConnect Client (Random)\ScreenConnect.ClientService.exe
Remote Workforce Client.exe
*\*\ScreenConnect.ClientService.exe
C:\Program Files (x86)\ScreenConnect Client (<string ID>)\*
*\ScreenConnect Client*\*
*\*\ScreenConnect.WindowsClient.exe
screenconnect*.exe
screenconnect.windowsclient.exe
ConnectWiseControl*.exe
connectwise*.exe
screenconnect.clientservice.exe
Code signing
- signer name
- ConnectWise, LLC
- certificate thumbprint
- 5C58CEA4608461C9A4188F480466123A9DD02431
- src file sha256
- a5c8ede4d24165797dcfbabbb85f62c44a79b058381e68249bf418a01fc67a1d
- src file path
- downloaded_files/screenconnect/a5c8ede4d24165797dcfbabbb85f62c44a79b058381e68249bf418a01fc67a1d
- src file company
- ScreenConnect Software
- signer name
- ConnectWise, LLC
- certificate thumbprint
- DD631BF0A610530A2C8C93B35609054E34FF5F70
- src file sha256
- c218eb4c68fafc90f1f9dde973ea85184c5a7cb830af174285d8b9e6ce6e1d06
- src file path
- downloaded_files/screenconnect/c218eb4c68fafc90f1f9dde973ea85184c5a7cb830af174285d8b9e6ce6e1d06
- src file company
- ScreenConnect Software
- signer name
- ConnectWise, LLC
- certificate thumbprint
- 11C81879E141A8407D461ADB14EF568A58022BEC
- src file sha256
- ee0fd474de7eb1b844ec8359a4453bfb56263191643c03919bd05f439761c722
- src file path
- downloaded_files/screenconnect/ee0fd474de7eb1b844ec8359a4453bfb56263191643c03919bd05f439761c722
- src file company
- ScreenConnect Software
- signer name
- ConnectWise, LLC
- certificate thumbprint
- F307637A290C1BCDCCC4437A58DE17C0BDBFC830
- src file sha256
- c79526ce6eed74a509c7192decb2ce8988578cdbe3400c68b66395f9c2941e40
- src file path
- downloaded_files/screenconnect/c79526ce6eed74a509c7192decb2ce8988578cdbe3400c68b66395f9c2941e40
- src file company
- ScreenConnect Software
- signer name
- ConnectWise, LLC
- certificate thumbprint
- 109D463C280A1E2AF6E87807C6F3D3E4A80E5DBE
- src file sha256
- 165f4ecf1727c7f57017fe460640e9b262657feb1af06d918f79917d100531fc
- src file path
- downloaded_files/screenconnect/165f4ecf1727c7f57017fe460640e9b262657feb1af06d918f79917d100531fc
- signer name
- ConnectWise, LLC
- certificate thumbprint
- 6B7B5475445B4829EE42A588FB8B5378783FEEF3
- src file sha256
- c13b80b70198ced667351ff7f004e6ab5972503049b66a053d55b30f9ea4c0e9
- src file path
- downloaded_files/screenconnect/c13b80b70198ced667351ff7f004e6ab5972503049b66a053d55b30f9ea4c0e9
- signer name
- ConnectWise, LLC
- certificate thumbprint
- 0F9CE6F3AA0A5C40790CEF493378990FDC766517
- src file sha256
- 46457d98fb1c53bbccb66c1015eb831355f30c8bf8e6f25cf3183aac2a5fd8ab
- src file path
- downloaded_files/screenconnect/46457d98fb1c53bbccb66c1015eb831355f30c8bf8e6f25cf3183aac2a5fd8ab
- src file company
- signer name
- ConnectWise, LLC
- certificate thumbprint
- B9E53B87C889BDBFEE481D49A6DC48289A27CE91
- src file sha256
- bc0b03a340d46c23a4a2f91ebd7ed4d0fcf92fc7c4323f522c86369ad483f68a
- src file path
- downloaded_files/screenconnect/bc0b03a340d46c23a4a2f91ebd7ed4d0fcf92fc7c4323f522c86369ad483f68a
- src file company
- signer name
- ConnectWise, LLC
- certificate thumbprint
- A913789BBC18D15773E26D320081E0BB1B0EC897
- src file sha256
- 0f39299c04c5c5f79a9a9400fd346adaf82c34b1d5ac38213fb42368f0267bfb
- src file path
- downloaded_files/screenconnect/0f39299c04c5c5f79a9a9400fd346adaf82c34b1d5ac38213fb42368f0267bfb
- src file company
- ConnectWise
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files*\ScreenConnect\App_Data\Session.db
- Description
- ScreenConnect session database
- OS
- Windows
- File
- C:\Program Files*\ScreenConnect\App_Data\User.xml
- Description
- ScreenConnect user configuration
- OS
- Windows
- File
- C:\ProgramData\ScreenConnect Client*\user.config
- Description
- ScreenConnect client user configuration
- OS
- Windows
- File
- C:\Program Files (x86)\ScreenConnect Client (*)\system.config
- Description
- Client configuration observed in the cited lab investigation. Contains the relay host (h=), port (p=) and RSA server key in the launch parameters; useful for recovering the configured destination offline, without proving a connection occurred.
- OS
- Windows
- File
- C:\Program Files*\ScreenConnect Client*\app.config
- Description
- Client UI configuration. The AccessShow* examples were observed set to false in abusive deployments, but their effect depends on client version; newer releases restrict hiding the banner and tray icon. Assess settings against the approved deployment and organization policy, not as proof of malicious activity.
- OS
- Windows
- Example
- AccessShowUnderControlBanner = false
- AccessShowBalloonOnConnect = false
- AccessShowSystemTrayIcon = false
- File
- C:\Windows\SystemTemp\ScreenConnect\*
- Description
- ScreenConnect working directory, with version-specific subdirectories. The cited lab observed RunFile staging beneath <version>\Temp; Huntress observed execution directly beneath <version>. Legitimate administrators also deploy files here. Correlate file writes and execution with session logs and approved activity; the path alone proves neither human interaction nor malicious intent.
- OS
- Windows
- File
- C:\Users\*\Downloads\ScreenConnect.ClientSetup*.exe
- Description
- ScreenConnect installer filename reported in Huntress's September 2026 Power BI phishing investigation (published October 7). The Downloads path generalizes the reported download destination; the filename can also occur in legitimate deployments. Observed URL pattern was <tenant>.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=<token>.
- OS
- Windows
- File
- C:\Temp\ScreenConnect.ClientSetup.msi
- Description
- MSI staging path reported by Huntress in the September 2026 investigation. SCAutoFix.ps1 downloaded a second client from /Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest and replaced the first client. This is a case-specific artifact, not a default installation path.
- OS
- Windows
- File
- C:\Users\ScreenConnect.ClientSetup*.exe
- Description
- Direct-under-Users path generalized from C:\Users\ScreenConnect.ClientSetup (6).exe in Huntress's September 2026 investigation. The report mentions both this EXE name and the MSI staging path; neither is a universal ScreenConnect installer location.
- OS
- Windows
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 7045
- ProviderName
- Service Control Manager
- LogFile
- System.evtx
- ServiceName
- ScreenConnect Client (<thumbprint>)
- ImagePath
- "C:\Program Files (x86)\ScreenConnect Client (<thumbprint>)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=<relay>&p=<port>&..."
- Description
- Service installation observed as LocalSystem with automatic startup in the cited lab. The service image path included launch parameters for session type (e=Access), relay host (h=) and port (p=). Distinct client thumbprints can identify multiple installations; compare with the approved inventory.
- EventID
- 100
- ProviderName
- ScreenConnect
- LogFile
- Application.evtx
- Description
- Host user connected. In the cited lab, the message included the session label, relay URL and instance fingerprint. Use as corroboration; absence of these application events does not exclude activity.
- EventID
- 101
- ProviderName
- ScreenConnect
- LogFile
- Application.evtx
- Description
- Host user disconnected. Corroborates the end of that connection; it does not establish that all operator activity or spawned processes have stopped.
- EventID
- 201
- ProviderName
- ScreenConnect
- LogFile
- Application.evtx
- Description
- Files transferred, with the action stated, e.g. "Transferred files with action 'Run': ScreenConnect.ClientSetup (1).msi".
FORENSIC EVIDENCE
Registry artifacts
- Path
- HKLM\System\CurrentControlSet\Services\ScreenConnect Client (*)\ImagePath
- Description
- Service ImagePath value can contain the relay host and port in client launch parameters. It can reveal a configured destination without network telemetry; the cited lab observed the registry write before DNS, but that event ordering is not guaranteed.
- Path
- HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
- Description
- The cited case reported ScreenConnect.WindowsAuthenticationPackage.dll in the Authentication Packages value. Investigate that DLL entry against the approved deployment and loaded module provenance; this shared Windows registry location alone identifies neither ScreenConnect nor malicious activity.
- Path
- HKLM\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C175-070CC4814204}
- Description
- Credential provider registration pointing to ScreenConnect.WindowsCredentialProvider.dll. Display name may be "SC FeedbackTool Credential Provider" in malicious deployments.
- Path
- HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (*)
- Description
- SafeBoot Network entry allowing ScreenConnect client to start in Safe Mode with Networking.
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- control.connectwise.com
- *.connectwise.com
- *.screenconnect.com
- Ports
- Not recorded
- Description
- Cloud relay pattern observed in the cited investigations on TCP 443. The installer download hostname can differ from the relay hostname; collect both. This pattern alone does not establish trial status or malicious use.
- Domains
- instance-*-relay.screenconnect.com
- Ports
- 443
- Description
- Default self-hosted relay port (configurable). The h= launch parameter or service ImagePath may contain a custom domain or IP address, so a ScreenConnect domain list alone can miss these deployments. Compare the destination with approved infrastructure.
- Domains
- Not recorded
- Ports
- 8041
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/screenconnect_registry_sigma.yml
- Description
- Detects potential registry activity of ScreenConnect RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/screenconnect_network_sigma.yml
- Description
- Detects potential network activity of ScreenConnect RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/screenconnect_files_sigma.yml
- Description
- Detects potential files activity of ScreenConnect RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/screenconnect_processes_sigma.yml
- Description
- Detects potential processes activity of ScreenConnect RMM tool
- Sigma
- https://github.com/SigmaHQ/sigma/blob/ca24243a6e3f94353a54176f83c4c3b7f579224a/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect.yml
- Description
- Remote Access Tool - ScreenConnect Execution
- Sigma
- https://github.com/SigmaHQ/sigma/blob/ca24243a6e3f94353a54176f83c4c3b7f579224a/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_child_proc.yml
- Description
- Remote Access Tool - ScreenConnect Remote Command Execution - Hunting
References
- https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/
- https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill
- https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud
- https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/
- https://www.screenconnect.com/blog/customization-update
- https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/
- https://www.huntress.com/blog/screenconnect-power-bi
Acknowledgements
- Person
- Ayush Anand
- Handle
- @Securityinbits