{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Adversaries are actively abusing trusted cloud domains like Power BI to deliver rogue RMMs. Identifying the scripted deployment and cloaking is critical to preventing long-term remote access." }, "name": "Rogue ScreenConnect Scripted Persistence and Evasion", "type": "investigation", "labels": [ "hunt", "attack.t1053.005", "attack.t1059.001", "attack.t1566", "command and control", "defense evasion", "execution", "initial access", "persistence" ], "series": { "slug": "phishing-campaign-abuses-microsoft-power-bi-to-deploy-rogue-rmms", "index": 2, "title": "Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs", "total": 2 }, "related": [ { "hunt": "initial-access-powerbi-phishing", "reason": "This hunt focuses on the post-infection endpoint activity rather than the initial phishing link delivery mechanism.", "relation": "out-of-scope-alternative" }, { "hunt": "power-bi-phishing-screenconnect-rmm", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule for ScreenConnect or scheduled tasks triggers too frequently in authorized contexts. This hunt correlates the specific multi-stage script logic (swapping instances) with custom evasion tools and fleet-wide rarity across three different telemetry surfaces.", "coverage": [ { "stage": "scripted-multi-stage-deployment", "steps": [ "script-deployment", "early-stage-read" ], "status": "covered" }, { "stage": "rmm-persistence-tasks", "steps": [ "persistence-tasks" ], "status": "covered" }, { "stage": "rmm-command-and-control", "steps": [ "dns-to-relays" ], "status": "covered" }, { "stage": "defense-evasion-cloaking", "steps": [ "evasion-tool" ], "status": "covered" }, { "stage": "initial-access-powerbi-phishing", "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.", "status": "out_of_scope" }, { "stage": "rmm-payload-download", "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Phishing via Power BI Dashboard", "slug": "initial-access-powerbi-phishing", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "app.powerbi.com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9", "dailylifeproject.site", "burnsworth.site", "essaywritingservice.site", "openpediatrics.site", "check.vykyn.click" ] }, { "name": "Rogue ScreenConnect Download", "slug": "rmm-payload-download", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "hamham27.screenconnect.com", "ScreenConnect.ClientSetup.exe", "5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3" ] }, { "name": "Scripted RMM Deployment", "slug": "scripted-multi-stage-deployment", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "LyN03DvVjUKPrun.cmd", "SCAutoFix.ps1", "C:\\Temp\\ScreenConnect.ClientSetup.msi", "ScreenConnect.ClientSetup (6).exe", "onthegotree.site" ] }, { "name": "Scheduled Task Persistence", "slug": "rmm-persistence-tasks", "tactic": "persistence", "techniques": [ "T1053.005" ], "observables": [ "SCAutoRepairEvery2Min" ] }, { "name": "RMM C2 Communication", "slug": "rmm-command-and-control", "tactic": "c2", "observables": [ "instance-g01s1n-relay.screenconnect.com" ] }, { "name": "Defense Evasion and Cloaking", "slug": "defense-evasion-cloaking", "tactic": "defense-evasion", "observables": [ "HideUL_x64.exe" ] } ], "summary": "Threat actors are abusing legitimate Microsoft Power BI links to bypass email filters and deliver rogue ScreenConnect RMM installers. The campaign utilizes multi-stage execution with CMD and PowerShell scripts to deploy redundant RMM instances, establishing persistence through scheduled tasks while using specialized tools to hide attacker activity." }, "severity": "high", "rationale": "Focus on endpoints running ScreenConnect specifically from temporary paths (e.g., %temp% or user Downloads); prioritize servers and administrative workstations.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using trusted Power BI domains to stage rogue RMM installers, which then use PowerShell scripts to rotate instances and establish persistent tasks while cloaking their presence with evasion tools.", "parameters": { "c2_domains": { "from": { "ref": "huntress-power-bi", "kind": "article", "observed": "2026-10-07" }, "type": "list[domain]", "default": [ "instance-g01s1n-relay.screenconnect.com", "onthegotree.site", "dailylifeproject.site", "burnsworth.site", "essaywritingservice.site", "openpediatrics.site" ], "description": "Reported rogue RMM relay and staging domains." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the hunt, often populated from the scoping step." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "deployment_scripts": { "from": { "ref": "huntress-power-bi", "kind": "article", "observed": "2026-10-07" }, "type": "list[path]", "default": [ "LyN03DvVjUKPrun.cmd", "SCAutoFix.ps1" ], "description": "Script names used for multi-stage RMM deployment and swapping." }, "persistence_task_name": { "from": { "ref": "huntress-power-bi", "kind": "article", "observed": "2026-10-07" }, "type": "string", "default": "SCAutoRepairEvery2Min", "description": "Name of the scheduled task created for persistence." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/screenconnect-power-bi", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/screenconnect-power-bi", "name": "Huntress \u2014 Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs" } ], "blind_spots": [ { "id": "no-script-block-logging", "risk": "Without script block logging, we see the script ran but not the specific commands it used to manipulate the ScreenConnect instances or uninstall previous versions.", "stage": "scripted-multi-stage-deployment", "question": "What specifically occurred during the execution of the SCAutoFix.ps1 script?", "requires": "hb_script_activity (PowerShell Script Block Logging)" }, { "id": "short-dns-retention", "risk": "If the initial infection occurred weeks ago, the DNS signal will be lost, leaving only the persistence task and active process as evidence.", "stage": "rmm-command-and-control", "question": "Did the host contact the relay domains prior to the current logging window?", "requires": "hb_dns_activity (historical logs)" } ] }, "name": "Rogue ScreenConnect Scripted Persistence and Evasion", "description": "This hunt identifies the post-infection lifecycle of a phishing campaign that abuses Microsoft Power BI. It follows a phased approach: first, it identifies hosts with rogue ScreenConnect activity and correlates it with known RMM relay domains and deployment scripts; second, it pivots to find secondary scripted persistence via rare scheduled tasks and the execution of the HideUL evasion tool. By weighing early-stage execution against follow-on persistence and evasion, the hunt identifies active intrusions that simple RMM-based alerts might miss." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "phishing-campaign-abuses-microsoft-power-bi-to-deploy-rogue-rmms", "index": 2, "title": "Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs", "total": 2 }, "coverage": [ { "stage": "scripted-multi-stage-deployment", "steps": [ "script-deployment", "early-stage-read" ], "status": "covered" }, { "stage": "rmm-persistence-tasks", "steps": [ "persistence-tasks" ], "status": "covered" }, { "stage": "rmm-command-and-control", "steps": [ "dns-to-relays" ], "status": "covered" }, { "stage": "defense-evasion-cloaking", "steps": [ "evasion-tool" ], "status": "covered" }, { "stage": "initial-access-powerbi-phishing", "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.", "status": "out_of_scope" }, { "stage": "rmm-payload-download", "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using trusted Power BI domains to stage rogue RMM installers, which then use PowerShell scripts to rotate instances and establish persistent tasks while cloaking their presence with evasion tools.", "blind_spots": [ { "id": "no-script-block-logging", "risk": "Without script block logging, we see the script ran but not the specific commands it used to manipulate the ScreenConnect instances or uninstall previous versions.", "stage": "scripted-multi-stage-deployment", "question": "What specifically occurred during the execution of the SCAutoFix.ps1 script?", "requires": "hb_script_activity (PowerShell Script Block Logging)" }, { "id": "short-dns-retention", "risk": "If the initial infection occurred weeks ago, the DNS signal will be lost, leaving only the persistence task and active process as evidence.", "stage": "rmm-command-and-control", "question": "Did the host contact the relay domains prior to the current logging window?", "requires": "hb_dns_activity (historical logs)" } ], "scoping_notes": "Focus on endpoints running ScreenConnect specifically from temporary paths (e.g., %temp% or user Downloads); prioritize servers and administrative workstations.", "beyond_detection": "A single rule for ScreenConnect or scheduled tasks triggers too frequently in authorized contexts. This hunt correlates the specific multi-stage script logic (swapping instances) with custom evasion tools and fleet-wide rarity across three different telemetry surfaces." } }, { "id": "scoping-screenconnect", "type": "query", "label": "Scope ScreenConnect Activity", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%screenconnect%' OR LOWER(process_cmd_line) LIKE '%screenconnect%') AND LOWER(process_cmd_line) LIKE '%temp%' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify hosts running ScreenConnect components or installers specifically from temporary directories to focus the hunt.", "expected_signal": "A list of hosts with ScreenConnect activity in temp paths. Silence is expected in clean environments." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope ScreenConnect Activity", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%screenconnect%' OR LOWER(process_cmd_line) LIKE '%screenconnect%') AND LOWER(process_cmd_line) LIKE '%temp%' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hosts with ScreenConnect activity in temp paths. Silence is expected in clean environments.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "dns-to-relays", "type": "query", "label": "DNS to RMM Relays", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_dns_activity", "description": "Match host DNS activity against known rogue ScreenConnect relay domains for the scoped host list.", "expected_signal": "DNS resolutions for reported rogue infrastructure from hosts showing suspicious RMM activity." }, "parents": [ { "id": "scoping-screenconnect" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS to RMM Relays", "reads": [ "device_hostname", "query_hostname", "process_name", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "DNS resolutions for reported rogue infrastructure from hosts showing suspicious RMM activity.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "script-deployment", "type": "query", "label": "Rogue Deployment Scripts", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, script_name, script_path, script_content, time FROM hb_script_activity WHERE (instr(',' || '{{deployment_scripts}}' || ',', ',' || LOWER(script_name) || ',') > 0 OR LOWER(script_content) LIKE '%scautofix%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Search script activity for the specific deployment commands used to swap RMM installers, gated by the scoped hosts.", "expected_signal": "Presence of reported script names or internal SCAutoFix logic on scoped hosts." }, "parents": [ { "id": "scoping-screenconnect" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Rogue Deployment Scripts", "reads": [ "device_hostname", "script_name", "script_path", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_name, script_path, script_content, time FROM hb_script_activity WHERE (instr(',' || '{{deployment_scripts}}' || ',', ',' || LOWER(script_name) || ',') > 0 OR LOWER(script_content) LIKE '%scautofix%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Presence of reported script names or internal SCAutoFix logic on scoped hosts.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "early-stage-read", "type": "analytic", "label": "Assess Early-Stage Infection", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scoping-screenconnect", "dns-to-relays", "script-deployment" ], "objective": "Determine if any host shows evidence of rogue ScreenConnect installation and deployment scripts.", "description": "Weigh scoping, DNS, and script evidence to confirm which hosts are compromised by the rogue RMM deployment.", "max_iterations": 3, "expected_signal": "A per-host verdict on the initial infection stage.", "success_criteria": "A list of hosts showing confirmed early-stage campaign signals." }, "parents": [ { "id": "dns-to-relays", "kind": "merge" }, { "id": "script-deployment", "kind": "merge" } ] }, { "id": "persistence-tasks", "type": "query", "label": "Scheduled Task Persistence", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT job_name, job_cmd_line, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE (LOWER(job_name) = LOWER('{{persistence_task_name}}') OR LOWER(job_cmd_line) LIKE '%scautofix.ps1%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY job_name, job_cmd_line HAVING hosts < 3", "surface": "hb_scheduled_job", "description": "Identify rare scheduled tasks that execute the deployment scripts on systems that showed rogue RMM activity.", "expected_signal": "A rare scheduled task appearing on scoped hosts referencing the rogue scripts." }, "parents": [ { "id": "early-stage-read" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Scheduled Task Persistence", "reads": [ "device_hostname", "job_name", "job_cmd_line", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT job_name, job_cmd_line, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE (LOWER(job_name) = LOWER('{{persistence_task_name}}') OR LOWER(job_cmd_line) LIKE '%scautofix.ps1%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY job_name, job_cmd_line HAVING hosts < 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A rare scheduled task appearing on scoped hosts referencing the rogue scripts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "job_name", "job_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-10-08" } }, { "id": "evasion-tool", "type": "query", "label": "HideUL Evasion Tool", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%hideul_x64.exe%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect the execution of HideUL_x64.exe on the same systems where the RMM was deployed.", "expected_signal": "Matches on the HideUL binary indicating active cloaking of the RMM." }, "parents": [ { "id": "early-stage-read" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "HideUL Evasion Tool", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%hideul_x64.exe%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Matches on the HideUL binary indicating active cloaking of the RMM.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "follow-on-read", "type": "analytic", "label": "Final Triage and Correlation", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-read", "persistence-tasks", "evasion-tool" ], "objective": "Confirm active, persistent, and cloaked RMM infections by weighing evidence from both deployment and persistence phases.", "description": "Correlate early-stage infection findings with persistence and evasion evidence to confirm the full attack chain.", "max_iterations": 5, "expected_signal": "A definitive per-host verdict citing the full path from initial rogue RMM to evasion.", "success_criteria": "A final verdict of malicious or suspicious per host with cited evidence." }, "parents": [ { "id": "persistence-tasks", "kind": "merge" }, { "id": "evasion-tool", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the follow-on-read verdict is malicious for at least one host", "condition": "the follow-on-read verdict is malicious for at least one host", "blind_spot": "no-script-block-logging", "confidence": "high", "description": "Direct the hunt towards containment or analyst review based on the final triage verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "follow-on-read" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate Compromised Host", "config": { "target": "endpoint", "description": "Contain the threat immediately by isolating the affected endpoint from the network.", "instructions": "Isolate the host and initiate forensic collection of any ScreenConnect installers or HideUL binaries found in temporary directories.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst Triage Review", "config": { "assignee": "analyst", "description": "Manually verify the findings, confirm the rogue nature of the ScreenConnect instances, and document tuning notes.", "instructions": "Review the DNS and PowerShell script rows; verify if the ScreenConnect instances are authorized and if the HideUL binary matches known malware hashes." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt Close Out", "config": { "assignee": "analyst", "description": "Finalize the hunt, document findings, and record whether the hypothesis was proven or refuted.", "instructions": "Document any variations in filenames or relay domains discovered during the hunt to update future detection logic." }, "parents": [ { "id": "analyst-review" } ] } ] }