CTI · reported · 2026-09-15

ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1210 Exploitation of Remote Services Lateral Movement
• T1570 Lateral Tool Transfer Lateral Movement

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: ScreenConnect Unauthorized Session Hijacking and File Execution
id: b2f1e8c4-3a7d-4e6f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects suspicious file creation or process execution in ScreenConnect install directories indicative of CVE-2026-84869 exploitation, where attackers hijack active sessions to upload and execute arbitrary files.
references:
  - https://securityweek.com/connectwise-screenconnect-cve-2026-84869
  - https://radar.offseq.com/screenconnect-worm
author: Tia N. List
date: 2026-09-15
tags:
  - attack.initial-access
  - attack.t1190
  - attack.lateral-movement
  - attack.t1210
logsource:
  category: file_event
  product: windows
detection:
  selection_screenconnect_write:
    TargetFilename|contains: '\ScreenConnect\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.cmd'
      - '.ps1'
      - '.vbs'
  selection_temp_to_screenconnect:
    Image|contains: '\ScreenConnect\'
    TargetFilename|contains:
      - '\Temp\'
      - '\AppData\'
  condition: selection_screenconnect_write or selection_temp_to_screenconnect
falsepositives:
  - Legitimate ScreenConnect updates and session file operations
level: critical

References

• https://securityweek.com/connectwise-screenconnect-cve-2026-84869
• https://radar.offseq.com/screenconnect-worm