{"id":9505,"date":"2026-07-14T08:57:02","date_gmt":"2026-07-14T06:57:02","guid":{"rendered":"https:\/\/www.cytomic.ai\/tendencias\/advanced-epdr-edr-identifies-legitimate-screenconnect-installations-as-malware\/"},"modified":"2026-08-04T14:30:33","modified_gmt":"2026-08-04T12:30:33","slug":"advanced-epdr-edr-identifica-screenconnect-como-malware","status":"publish","type":"post","link":"https:\/\/www.cytomic.ai\/es\/soporte\/advanced-epdr-edr-identifica-screenconnect-como-malware\/","title":{"rendered":"Advanced EPDR\/EDR identifica las instalaciones leg\u00edtimas de ScreenConnect como malware"},"content":{"rendered":"[vc_row type=&#8221;full_width_background&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; equal_height=&#8221;yes&#8221; content_placement=&#8221;middle&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; bg_color=&#8221;#7e5994&#8243; scene_position=&#8221;center&#8221; top_padding=&#8221;12&#8243; bottom_padding=&#8221;12&#8243; text_color=&#8221;light&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221; shape_type=&#8221;&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;3\/5&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;][\/vc_column][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/5&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;]<div class=\"iwithtext\"><div class=\"iwt-icon\"> <img decoding=\"async\" src=\"https:\/\/www.cytomic.ai\/src\/uploads\/2020\/03\/support-tiny.svg\" alt=\"\" \/> <\/div><div class=\"iwt-text\"> +34 900 840 407 <\/div><div class=\"clear\"><\/div><\/div>[\/vc_column][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/5&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;]<div class=\"iwithtext\"><div class=\"iwt-icon\"> <img decoding=\"async\" src=\"https:\/\/www.cytomic.ai\/src\/uploads\/2020\/03\/contact-tiny.svg\" alt=\"\" \/> <\/div><div class=\"iwt-text\"> support@cytomic.ai <\/div><div class=\"clear\"><\/div><\/div>[\/vc_column][\/vc_row][vc_row type=&#8221;full_width_content&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; equal_height=&#8221;yes&#8221; content_placement=&#8221;top&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221; shape_type=&#8221;&#8221;][vc_column column_padding=&#8221;padding-5-percent&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color=&#8221;#f3f3f3&#8243; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/3&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;][split_line_heading animation_type=&#8221;default&#8221;]<a href=\"#title1\">Productos Relacionados_<\/a><\/p>\n<p><a href=\"#title2\">Descripci\u00f3n_<\/a><\/p>\n<p><a href=\"#title3\">Soluci\u00f3n_<\/a>[\/split_line_heading][\/vc_column][vc_column column_padding=&#8221;padding-5-percent&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;2\/3&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;][vc_column_text]\n<h3>Advanced EPDR\/EDR identifica las instalaciones leg\u00edtimas de ScreenConnect como malware<\/h3>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1784012282739{padding-top: 40px !important;padding-bottom: 20px !important;}&#8221;]\n<h6 id=\"title1\">Productos Relacionados_<\/h6>\n[\/vc_column_text][vc_column_text]\n<ul>\n<li>Advanced EPDR<\/li>\n<li>Advanced EDR<\/li>\n<\/ul>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1784012293575{padding-top: 40px !important;padding-bottom: 20px !important;}&#8221;]\n<h6 id=\"title2\">Descripci\u00f3n_<\/h6>\n[\/vc_column_text][vc_column_text]Las herramientas de supervisi\u00f3n y gesti\u00f3n remotas (RMM), entre las que se incluye ScreenConnect, son cada vez m\u00e1s utilizadas de forma indebida por los autores de amenazas para establecer acceso remoto y mantener la persistencia en los sistemas comprometidos.<\/p>\n<p>Para reducir el riesgo asociado a las herramientas de acceso remoto no autorizadas, Advanced EPDR\/EDR ha introducido una regla de detecci\u00f3n para identificar y bloquear las instalaciones de ScreenConnect iniciadas al margen de los mecanismos de implementaci\u00f3n corporativos aprobados.<\/p>\n<p>Como resultado, los usuarios ya no podr\u00e1n descargar e instalar ScreenConnect directamente desde Internet ni desde otras fuentes no aprobadas.<\/p>\n<p><strong>\u00bfQu\u00e9 se bloquear\u00e1?<\/strong><\/p>\n<ul>\n<li>Las instalaciones manuales de ScreenConnect realizadas por los usuarios finales.<\/li>\n<li>Los instaladores de ScreenConnect descargados de sitios web externos o fuentes no autorizadas.<\/li>\n<li>Los m\u00e9todos de instalaci\u00f3n que no procedan de herramientas corporativas autorizadas para la implementaci\u00f3n de software.<\/li>\n<\/ul>\n<p><strong>\u00bfQu\u00e9 est\u00e1 permitido?<\/strong><\/p>\n<ul>\n<li>Las instalaciones de ScreenConnect realizadas a trav\u00e9s de plataformas corporativas autorizadas de distribuci\u00f3n de software y procesos de implementaci\u00f3n gestionados por el departamento de TI.<\/li>\n<\/ul>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1784012343967{padding-top: 40px !important;padding-bottom: 20px !important;}&#8221;]\n<h6 id=\"title3\">Soluci\u00f3n_<\/h6>\n[\/vc_column_text][vc_column_text]\n<h2>Falsos positivos<\/h2>\n<p>Las instalaciones leg\u00edtimas iniciadas directamente desde un navegador web podr\u00edan bloquearse si la fuente de conexi\u00f3n se identifica como externa.<\/p>\n<p>Hay dos escenarios habituales en los que las instalaciones leg\u00edtimas de ScreenConnect podr\u00edan bloquearse:<\/p>\n<ul>\n<li>Uso frecuente, normalmente por parte de los equipos de soporte t\u00e9cnico, en el que los instaladores pueden variar de una descarga a otra.<\/li>\n<li>Uso ocasional, en el que se utiliza un instalador espec\u00edfico con poca frecuencia y se puede crear una excepci\u00f3n seg\u00fan sea necesario.<\/li>\n<\/ul>\n<p><strong>Escenario 1:<\/strong> <strong>Uso frecuente de ScreenConnect con nombres de instalador variables<\/strong><\/p>\n<p>Cuando ScreenConnect se utiliza de forma frecuente, por ejemplo, por parte de los equipos de asistencia t\u00e9cnica, el instalador puede variar de una descarga a otra. Para evitar tener que crear exclusiones individuales para cada instalador, como soluci\u00f3n alternativa, configura una exclusi\u00f3n de archivos utilizando el siguiente patr\u00f3n de comod\u00edn: <strong>screenconnect.client*.exe<\/strong><\/p>\n<p>Para obtener m\u00e1s informaci\u00f3n sobre las exclusiones, consulta la ayuda sobre\u00a0<a href=\"https:\/\/info.cytomicmodel.com\/resources\/help\/EPDR\/latest\/es\/Content\/12_security_settings_workstations_servers\/general_settings.htm\" target=\"_blank\" rel=\"noopener noreferrer\">Exclusiones de archivos<\/a>.<\/p>\n<p>Para aplicar exclusiones en varios entornos de clientes desde Cytomic Nexus, consulta la ayuda sobre <a href=\"https:\/\/nexus-documents.cytomic.ai\/Help\/v77000\/Partners\/es-es\/Content\/08_settings_management_for_Aether-based_products\/settings_management_aether.htm\" target=\"_blank\" rel=\"noopener noreferrer\">Configuraci\u00f3n de productos de seguridad desde Cytomic Nexus<\/a>.<\/p>\n<p>Siempre que sea posible, contacta con soporte t\u00e9cnico para encontrar una soluci\u00f3n para tu caso concreto.<\/p>\n<p><strong>Habilitar excepciones desde la p\u00e1gina de detalles de detecciones de malware<\/strong><\/p>\n<p>Sigue estos pasos para habilitar una excepci\u00f3n en la consola de Aether desde la p\u00e1gina de detalles de detecci\u00f3n de malware y permitir la ejecuci\u00f3n de ScreenConnect cuando se clasifique como malware:<\/p>\n<ol>\n<li>Selecciona\u00a0<strong>Estado\u00a0<\/strong>&gt;\u00a0<strong>Seguridad<\/strong>.<\/li>\n<li>Haz clic en el mosaico\u00a0<strong>Actividad de malware<\/strong>.<\/li>\n<li>En la lista, selecciona la amenaza cuya ejecuci\u00f3n deseas permitir (BHV\/RMM.ScrCon).<\/li>\n<li>En la p\u00e1gina de detalles, haz clic en el icono de informaci\u00f3n situado junto a la acci\u00f3n.<\/li>\n<li>Aparecer\u00e1 un cuadro de di\u00e1logo emergente que describe la acci\u00f3n realizada por Advanced EPDR\/EDR.<\/li>\n<li>Haz clic en\u00a0<strong>No volver a detectar<\/strong>.<\/li>\n<\/ol>\n<p>Para obtener m\u00e1s informaci\u00f3n, consulta\u00a0<a href=\"https:\/\/info.cytomicmodel.com\/resources\/help\/EPDR\/latest\/es\/Content\/22_manage_threats_items_quarantine\/allow_prevent_items_run.htm?Highlight=allow%20blocked%20items\" target=\"_blank\" rel=\"noopener noreferrer\">Permitir la ejecuci\u00f3n de elementos bloqueados<\/a>\u00a0en la ayuda online.[\/vc_column_text][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"<p>[vc_row type=&#8221;full_width_background&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; equal_height=&#8221;yes&#8221; content_placement=&#8221;middle&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; bg_color=&#8221;#7e5994&#8243; scene_position=&#8221;center&#8221; top_padding=&#8221;12&#8243; bottom_padding=&#8221;12&#8243; text_color=&#8221;light&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221; shape_type=&#8221;&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221;&#8230;<\/p>\n","protected":false},"author":4,"featured_media":414,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[32,495,502,33,496,497,27],"tags":[],"class_list":{"0":"post-9505","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-edr","8":"category-edr-problemas-conocidos","9":"category-edr-problemas-conocidos-abiertos","10":"category-epdr","11":"category-advanced-epdr-problemas-conocidos","12":"category-epdr-problemas-conocidos-abiertos","13":"category-soporte"},"_links":{"self":[{"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/posts\/9505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/comments?post=9505"}],"version-history":[{"count":5,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/posts\/9505\/revisions"}],"predecessor-version":[{"id":9530,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/posts\/9505\/revisions\/9530"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/media\/414"}],"wp:attachment":[{"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/media?parent=9505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/categories?post=9505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/tags?post=9505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}