{"id":9505,"date":"2026-07-14T08:57:02","date_gmt":"2026-07-14T06:57:02","guid":{"rendered":"https:\/\/www.cytomic.ai\/tendencias\/advanced-epdr-edr-identifies-legitimate-screenconnect-installations-as-malware\/"},"modified":"2026-07-14T09:04:46","modified_gmt":"2026-07-14T07:04:46","slug":"advanced-epdr-edr-identifica-screenconnect-como-malware","status":"publish","type":"post","link":"https:\/\/www.cytomic.ai\/es\/soporte\/advanced-epdr-edr-identifica-screenconnect-como-malware\/","title":{"rendered":"Advanced EPDR\/EDR identifica las instalaciones leg\u00edtimas de ScreenConnect como malware"},"content":{"rendered":"[vc_row type=&#8221;full_width_background&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; equal_height=&#8221;yes&#8221; content_placement=&#8221;middle&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; bg_color=&#8221;#7e5994&#8243; scene_position=&#8221;center&#8221; top_padding=&#8221;12&#8243; bottom_padding=&#8221;12&#8243; text_color=&#8221;light&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221; shape_type=&#8221;&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;3\/5&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;][\/vc_column][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/5&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;]<div class=\"iwithtext\"><div class=\"iwt-icon\"> <img decoding=\"async\" src=\"https:\/\/www.cytomic.ai\/src\/uploads\/2020\/03\/support-tiny.svg\" alt=\"\" \/> <\/div><div class=\"iwt-text\"> +34 900 840 407 <\/div><div class=\"clear\"><\/div><\/div>[\/vc_column][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/5&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;]<div class=\"iwithtext\"><div class=\"iwt-icon\"> <img decoding=\"async\" src=\"https:\/\/www.cytomic.ai\/src\/uploads\/2020\/03\/contact-tiny.svg\" alt=\"\" \/> <\/div><div class=\"iwt-text\"> support@cytomic.ai <\/div><div class=\"clear\"><\/div><\/div>[\/vc_column][\/vc_row][vc_row type=&#8221;full_width_content&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; equal_height=&#8221;yes&#8221; content_placement=&#8221;top&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221; shape_type=&#8221;&#8221;][vc_column column_padding=&#8221;padding-5-percent&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color=&#8221;#f3f3f3&#8243; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/3&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;][split_line_heading animation_type=&#8221;default&#8221;]<a href=\"#title1\">Productos Relacionados_<\/a><\/p>\n<p><a href=\"#title2\">Descripci\u00f3n_<\/a><\/p>\n<p><a href=\"#title3\">Soluci\u00f3n_<\/a>[\/split_line_heading][\/vc_column][vc_column column_padding=&#8221;padding-5-percent&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;2\/3&#8243; tablet_width_inherit=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221; bg_image_animation=&#8221;none&#8221;][vc_column_text]\n<h3>Advanced EPDR\/EDR identifica las instalaciones leg\u00edtimas de ScreenConnect como malware<\/h3>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1784012282739{padding-top: 40px !important;padding-bottom: 20px !important;}&#8221;]\n<h6 id=\"title1\">Productos Relacionados_<\/h6>\n[\/vc_column_text][vc_column_text]\n<ul>\n<li>Advanced EPDR<\/li>\n<li>Advanced EDR<\/li>\n<\/ul>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1784012293575{padding-top: 40px !important;padding-bottom: 20px !important;}&#8221;]\n<h6 id=\"title2\">Descripci\u00f3n_<\/h6>\n[\/vc_column_text][vc_column_text]Las herramientas de supervisi\u00f3n y gesti\u00f3n remotas (RMM), entre las que se incluye ScreenConnect, son cada vez m\u00e1s utilizadas de forma indebida por los autores de amenazas para establecer acceso remoto y mantener la persistencia en los sistemas comprometidos.<\/p>\n<p>Para reducir el riesgo asociado a las herramientas de acceso remoto no autorizadas, Advanced EPDR\/EDR ha introducido una regla de detecci\u00f3n para identificar y bloquear las instalaciones de ScreenConnect iniciadas al margen de los mecanismos de implementaci\u00f3n corporativos aprobados.<\/p>\n<p>Como resultado, los usuarios ya no podr\u00e1n descargar e instalar ScreenConnect directamente desde Internet ni desde otras fuentes no aprobadas.<\/p>\n<p><strong>\u00bfQu\u00e9 se bloquear\u00e1?<\/strong><\/p>\n<ul>\n<li>Las instalaciones manuales de ScreenConnect realizadas por los usuarios finales.<\/li>\n<li>Los instaladores de ScreenConnect descargados de sitios web externos o fuentes no autorizadas.<\/li>\n<li>Los m\u00e9todos de instalaci\u00f3n que no procedan de herramientas corporativas autorizadas para la implementaci\u00f3n de software.<\/li>\n<\/ul>\n<p><strong>\u00bfQu\u00e9 est\u00e1 permitido?<\/strong><\/p>\n<ul>\n<li>Las instalaciones de ScreenConnect realizadas a trav\u00e9s de plataformas corporativas autorizadas de distribuci\u00f3n de software y procesos de implementaci\u00f3n gestionados por el departamento de TI.<\/li>\n<\/ul>\n[\/vc_column_text][vc_column_text css=&#8221;.vc_custom_1784012343967{padding-top: 40px !important;padding-bottom: 20px !important;}&#8221;]\n<h6 id=\"title3\">Soluci\u00f3n_<\/h6>\n[\/vc_column_text][vc_column_text]\n<h2>Falsos positivos<\/h2>\n<p>Las instalaciones leg\u00edtimas iniciadas directamente desde un navegador web podr\u00edan bloquearse si la fuente de conexi\u00f3n se identifica como externa. Si tu organizaci\u00f3n utiliza este m\u00e9todo de instalaci\u00f3n, puedes habilitar una excepci\u00f3n en la consola de Advanced EPDR\/EDR en cualquiera de estas ubicaciones:<\/p>\n<ul>\n<li>P\u00e1gina de detalles del incidente<\/li>\n<li>P\u00e1gina de detalles de la detecci\u00f3n de malware<\/li>\n<\/ul>\n<p><strong>Habilitar excepciones desde la p\u00e1gina de detalles del incidente<\/strong><\/p>\n<p>Para permitir la ejecuci\u00f3n de ScreenConnect cuando se identifique como un incidente, en la consola:<\/p>\n<ol>\n<li>Selecciona\u00a0<strong>Estado\u00a0<\/strong>&gt;\u00a0<strong>Seguridad<\/strong>.<\/li>\n<li>Haz clic en el mosaico\u00a0<strong>Estado del incidente<\/strong>.<\/li>\n<li>Filtra la lista de incidentes para mostrar \u00fanicamente los incidentes de archivos maliciosos.<\/li>\n<li>En la lista, selecciona el incidente que incluye la detecci\u00f3n de se\u00f1al cuya ejecuci\u00f3n deseas permitir.<\/li>\n<li>En el panel\u00a0<strong>Se\u00f1ales<\/strong>, selecciona la se\u00f1al que deseas excluir (BHV\/RMM.ScrCon).<\/li>\n<li>Haz clic en\u00a0<img decoding=\"async\" title=\"\" src=\"https:\/\/www.watchguard.com\/help\/docs\/help-center\/en-US\/Content\/en-US\/Endpoint-Security\/images\/icon-options.png\" alt=\"\" \/>\u00a0. Selecciona\u00a0<strong>No volver a detectar<\/strong>.<\/li>\n<li>En el cuadro de di\u00e1logo de confirmaci\u00f3n, haga clic en\u00a0<strong>No volver a detectar<\/strong>.<\/li>\n<\/ol>\n<p>La regla elimina todas las se\u00f1ales que cumplen los criterios definidos en la misma. Las excepciones de se\u00f1ales se muestran en el mosaico y la lista\u00a0<strong>Elementos detectados permitidos por el administrador<\/strong>. La lista\u00a0<strong>Incidentes\u00a0<\/strong>muestra el estado de las se\u00f1ales eliminadas autom\u00e1ticamente como\u00a0<strong>Cerrado autom\u00e1ticamente<\/strong>.<\/p>\n<p><strong>Habilitar excepciones desde la p\u00e1gina de detalles de detecciones de malware<\/strong><\/p>\n<p>Para permitir la ejecuci\u00f3n de ScreenConnect cuando se clasifica como malware, en la interfaz de usuario de gesti\u00f3n o en la consola:<\/p>\n<ol>\n<li>Selecciona\u00a0<strong>Estado\u00a0<\/strong>&gt;\u00a0<strong>Seguridad<\/strong>.<\/li>\n<li>Haz clic en el mosaico\u00a0<strong>Actividad de malware<\/strong>.<\/li>\n<li>En la lista, selecciona la amenaza cuya ejecuci\u00f3n deseas permitir (BHV\/RMM.ScrCon).<\/li>\n<li>En la p\u00e1gina de detalles, haz clic en el icono de informaci\u00f3n situado junto a la acci\u00f3n.<\/li>\n<li>Aparecer\u00e1 un cuadro de di\u00e1logo emergente que describe la acci\u00f3n realizada por Advanced EPDR\/EDR.<\/li>\n<li>Haz clic en\u00a0<strong>No volver a detectar<\/strong>.<\/li>\n<\/ol>\n<p>Para obtener m\u00e1s informaci\u00f3n, consulta\u00a0<a href=\"https:\/\/info.cytomicmodel.com\/resources\/help\/EPDR\/latest\/es\/Content\/22_manage_threats_items_quarantine\/allow_prevent_items_run.htm?Highlight=allow%20blocked%20items\" target=\"_blank\" rel=\"noopener noreferrer\">Permitir la ejecuci\u00f3n de elementos bloqueados<\/a>\u00a0en la ayuda online.[\/vc_column_text][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"<p>[vc_row type=&#8221;full_width_background&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; equal_height=&#8221;yes&#8221; content_placement=&#8221;middle&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; bg_color=&#8221;#7e5994&#8243; scene_position=&#8221;center&#8221; top_padding=&#8221;12&#8243; bottom_padding=&#8221;12&#8243; text_color=&#8221;light&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221; shape_type=&#8221;&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221;&#8230;<\/p>\n","protected":false},"author":4,"featured_media":414,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[32,495,502,33,496,497,27],"tags":[],"class_list":{"0":"post-9505","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-edr","8":"category-edr-problemas-conocidos","9":"category-edr-problemas-conocidos-abiertos","10":"category-epdr","11":"category-advanced-epdr-problemas-conocidos","12":"category-epdr-problemas-conocidos-abiertos","13":"category-soporte"},"_links":{"self":[{"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/posts\/9505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/comments?post=9505"}],"version-history":[{"count":3,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/posts\/9505\/revisions"}],"predecessor-version":[{"id":9508,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/posts\/9505\/revisions\/9508"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/media\/414"}],"wp:attachment":[{"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/media?parent=9505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/categories?post=9505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cytomic.ai\/es\/wp-json\/wp\/v2\/tags?post=9505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}