# Update/new rule needed for ScreenConnect? sid:2036627 **URL:** \ **Category:** Feedback & Support\ **Created:** [September 13, 2023, 7:36am UTC](https://community.emergingthreats.net/t/update-new-rule-needed-for-screenconnect-sid-2036627/938 "2023-09-13T07:36:21Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![j0hnb3r00t](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/j0hnb3r00t/32/226_2.png) [@j0hnb3r00t](https://community.emergingthreats.net/u/j0hnb3r00t)\ **Post date:** [September 13, 2023, 7:36am UTC](https://community.emergingthreats.net/t/update-new-rule-needed-for-screenconnect-sid-2036627/938/1 "2023-09-13T07:36:21Z")
Hello, While I was following a campaign using ScreenConnect maliciously, I noticed that the initial checkin packet may have changed. As can be seen in the screenshot below, it looks like it is now “87 1 **C** 10” instead of “87 1 **5** 10”. ![image](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/e539fefa1541e4adca0968fb4fb8ae3ee145ce72.png) Here is the link to this specific any.run analysis: [Analysis hgsuhfs.exe (MD5: A047BFE20C52C21BC6060FF0F763C235) Malicious activity - Interactive analysis ANY.RUN](https://app.any.run/tasks/74030a66-0d50-4d2d-ae95-17489b5fabcf/) Regards, John ---
**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\ **Post date:** [September 13, 2023, 4:21pm UTC](https://community.emergingthreats.net/t/update-new-rule-needed-for-screenconnect-sid-2036627/938/2 "2023-09-13T16:21:11Z")
@j0hnb3r00t - Thanks for sharing! we’ll get another signature out today to catch this checkin variant. 🕶 ````auto 2048051 - ET POLICY ScreenConnect-ConnectWise Initial Checkin Packet M2``` ````