Advanced EPDR/EDR identifies legitimate ScreenConnect installations as malware
Related Products_
- Advanced EPDR
- Advanced EDR
Description_
Remote monitoring and management (RMM) tools, including ScreenConnect, are increasingly abused by threat actors to establish remote access and maintain persistence on compromised systems.
To reduce the risk associated with unauthorized remote access tools, Advanced EPDR/EDR introduced a detection rule to identify and block ScreenConnect installations initiated outside of approved corporate deployment mechanisms.
As a result, users will no longer be able to download and install ScreenConnect directly from the Internet or other non-approved sources.
What will be blocked?
- Manual ScreenConnect installations performed by end users.
- ScreenConnect installers downloaded from external websites or unapproved sources.
- Installation methods that do not originate from authorized corporate software deployment tools.
What is allowed?
- ScreenConnect installations deployed through approved corporate software distribution platforms and IT-managed deployment processes.
Solution_
False Positives
Legitimate installations launched directly from a web browser when the connection source is identified as external could be blocked.
There are two common scenarios where legitimate ScreenConnect installations might be blocked:
- Frequent use, generally by Support teams, where installers may vary between downloads.
- Occasional use, where a specific installer is used infrequently and an exception can be created as needed.
Scenario 1: Frequent ScreenConnect Use with Variable Installer Names
When ScreenConnect is used extensively, for example by Support teams, the installer can vary between downloads.
To avoid creating individual exclusions for each installer, as a workaround, configure a file exclusion using the following wildcard pattern: screenconnect.client*.exe
To learn more about exclusions, see File Exclusions.
To apply exclusions across multiple customer environments from Cytomic Nexus, see Security Product Settings from Cytomic Nexus.
When possible, open a Support case to find a more targeted solution.
Scenario 2: Occasional Use of ScreenConnect
Follow these steps to enable an exception in the Aether console from the malware detection details page and allow execution of ScreenConnect when it is classified as malware:
- Select Status > Security.
- Click the Malware Activity tile.
- From the list, select the threat that you want to allow to run (BHV/RMM.ScrCon)..
- On the details page, click the info icon next to the action.
A pop-up dialog box describes the action taken by Advanced EPDR/EDR. - Click Do Not Detect Again.
For more information, go to Allow Blocked Items to Run in the online help.
