From the Field: Investigating an Unauthorized ScreenConnect Session

The alert looked ordinary for about five seconds.An endpoint protection product had detected and quarantined an executable named WindowsUpdate.exe. The name was suspicious but not especially creative. The path was what changed the investigation:C:\Users\<user>\Documents\ScreenConnect\Temp\WindowsUpdate.exeThis client did not use ScreenConnect.The endpoint record also showed a ScreenConnect RunFile action, an active remote session, and components associated with backstage shell and file-manager access. The antivirus engine reported the file as malware and said it had been quarantined successfully, but the execution status was unknown.That last field mattered. Quarantine meant the product had acted on the file. It did not prove that the file had never run, that the remote session had done nothing else, or that the system was clean.The endpoint alert confirmed that the suspicious executable had been quarantined. Client, endpoint, technician, address, policy, and timestamp details have…