Update/new rule needed for ScreenConnect? sid:2036627

[j0hnb3r00t]

Hello,

While I was following a campaign using ScreenConnect maliciously, I noticed that the initial checkin packet may have changed.
As can be seen in the screenshot below, it looks like it is now “87 1C 10” instead of “87 15 10”.

Here is the link to this specific any.run analysis: Analysis hgsuhfs.exe (MD5: A047BFE20C52C21BC6060FF0F763C235) Malicious activity - Interactive analysis ANY.RUN

Regards,

John

[ishaughnessy]

@j0hnb3r00t - Thanks for sharing! we’ll get another signature out today to catch this checkin variant.

 2048051 - ET POLICY ScreenConnect-ConnectWise Initial Checkin Packet M2```