SCKit Endpoint Hijacking and Persistence

Source

---
analysis: A single detection rule would fire on the TrapWatch task name, but SCKit
  rotates its indicators. This hunt uses a phased approach, correlating the presence
  of ScreenConnect with loader behaviour and high-frequency persistence, providing
  the context an analyst needs to distinguish a malicious hijack from a technician's
  legitimate automation.
blind_spots:
- id: missing-endpoint-telemetry
  question: Are there ScreenConnect clients that we cannot observe?
  requires: an endpoint agent (osquery/sysmon) on every host with ScreenConnect
  risk: A host without an agent provides no process, task, or registry telemetry,
    making it a blind spot where SCKit can persist and spread undetected.
- id: http-post-body-blindness
  question: Can we see the blank RMMPlus.AccessKey in the POST request?
  requires: hb_http_activity with POST body content
  risk: Standard HTTP telemetry does not capture the POST body; exploitation of the
    RMM+ extension is inferred from the subsequent loader activity rather than directly
    observed.
  stage: rmm-plus-extension-exploitation
coverage:
- blind_spot: http-post-body-blindness
  reason: The blank access key is sent in the POST body, which is not captured by
    hb_http_activity.
  stage: rmm-plus-extension-exploitation
  status: not_visible
- stage: scripted-loader-execution
  status: covered
  steps:
  - loader-process-activity
  - c2-dns-activity
- stage: trapwatch-task-persistence
  status: covered
  steps:
  - persistence-task-trapwatch
- stage: registry-run-persistence
  status: covered
  steps:
  - persistence-registry-activity
- reason: Belongs to another part of the 'SCKit Worm Installs Rogue ScreenConnect
    Clients and Session Cookie Relays Across Hundreds of Endpoints' series.
  stage: session-cookie-harvesting
  status: out_of_scope
- reason: Belongs to another part of the 'SCKit Worm Installs Rogue ScreenConnect
    Clients and Session Cookie Relays Across Hundreds of Endpoints' series.
  stage: lateral-toolbox-propagation
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: SCKit is an aggressive worm specifically designed to hijack remote
    management sessions. A successful infection compromises the organization's primary
    IT management channel, allowing an attacker to push malicious code across the
    entire fleet via the technician's workstation.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An intruder has exploited vulnerable ScreenConnect extensions to deploy
  the SCKit toolkit, which hijacks legitimate management sessions through aggressive
  scheduled tasks and registry persistence.
labels:
- hunt
- attack.t1053.005
- attack.t1059.001
- attack.t1190
- attack.t1547.001
- credential access
- execution
- initial access
- lateral movement
- persistence
name: SCKit Endpoint Hijacking and Persistence
parameters:
  c2_domains:
    default:
    - ns.mo7sen.dev
    - cdn007-digitaldownloads.com
    - relaytrap.cs
    - newnewnew.gotdns.org
    - sc.payproofkit.com
    - soxnewwork.homedns.org
    description: C2 and staging domains named in the report.
    from:
      kind: article
      observed: '2026-11-12'
      ref: huntress-sckit-worm
    type: list[domain]
  loader_indicators:
    default:
    - Stage0Loader.ps1
    - sckit-loader.ps1
    - Run-Lateral-Full.bat
    - sckit-decoder.ps1
    - TrapWatch.ps1
    - Lite-Alert.ps1
    description: Filenames and strings associated with the SCKit infection chain.
    from:
      kind: article
      observed: '2026-11-12'
      ref: huntress-sckit-worm
    type: list[string]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Hosts identified with ScreenConnect; leave empty to run against the
      whole estate.
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: Target hosts where ScreenConnect is installed. If the software inventory
  is large, prioritize servers and workstations belonging to IT technicians, as they
  are the primary conduits for SCKit's lateral propagation.
references:
- name: "Huntress \u2014 SCKit Worm Installs Rogue ScreenConnect Clients"
  url: https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
related:
- hunt: sckit-cookie-theft-lateral-propagation
  reason: This hunt focuses on the endpoint hijack; the subsequent lateral propagation
    through stolen session cookies is covered in the next hunt in this series.
  relation: follows
scenario:
  stages:
  - name: RMM+ Extension Authentication Bypass
    observables:
    - POST requests to ScreenConnect servers with blank RMMPlus.AccessKey
    - RMM+ versions 1.0.31 and 1.0.32
    slug: rmm-plus-extension-exploitation
    tactic: initial-access
    techniques:
    - T1190
  - name: Scripted Loader and Payload Delivery
    observables:
    - Stage0Loader.ps1
    - Run-Lateral-Full.bat
    - sckit-loader.ps1
    - ns.mo7sen.dev/EadF.php?p=1
    - '%TEMP%\k<guid>.ps1'
    - cdn007-digitaldownloads.com
    slug: scripted-loader-execution
    tactic: execution
    techniques:
    - T1059.001
  - name: High-Frequency Scheduled Task Persistence
    observables:
    - 'Task name: TrapWatch'
    - 'Command: TrapWatch.ps1'
    - 'Frequency: Every 10 seconds'
    - Runs as SYSTEM
    slug: trapwatch-task-persistence
    tactic: persistence
    techniques:
    - T1053.005
  - name: Registry Run Key Persistence
    observables:
    - 'Run key name: RelayTrapLiteAlert'
    - 'Command: Lite-Alert.ps1'
    - C:\ProgramData\RelayTrap
    slug: registry-run-persistence
    tactic: persistence
    techniques:
    - T1547.001
  - name: Technician Session Cookie Theft
    observables:
    - sqlite3.exe reading browser cookie databases
    - Panel-Lateral.ps1
    - LabConfig.ps1
    - ns.mo7sen.dev/EadF.php?p=5
    slug: session-cookie-harvesting
    tactic: credential-access
    techniques:
    - T1059.001
  - name: Shared Toolbox Lateral Propagation
    observables:
    - ToolboxRelayUploader.exe using stolen tokens
    - AddToToolbox command on ScreenConnect panels
    - sc.payproofkit.com
    - 185.99.255.28
    - 155.94.150.39
    slug: lateral-toolbox-propagation
    tactic: lateral-movement
    techniques:
    - T1059.001
  summary: Attackers exploit an authentication flaw in the third-party RMM+ extension
    for ScreenConnect to push commands to managed endpoints. The resulting SCKit worm
    establishes persistence via high-frequency scheduled tasks and registry keys,
    hijacks legitimate client connections, and steals technician session cookies to
    propagate laterally through the ScreenConnect shared toolbox.
series:
  index: 1
  slug: sckit-worm-installs-rogue-screenconnect-clients-and-session-cookie-relays-across-hundreds-of-end
  title: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays
    Across Hundreds of Endpoints
  total: 2
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
tlp: clear
type: investigation
---


# SCKit Endpoint Hijacking and Persistence

An adversary exploits vulnerable ScreenConnect extensions to deploy the SCKit toolkit, which hijacks legitimate management sessions through aggressive scheduled tasks and registry persistence. This hunt identifies the ScreenConnect estate and then searches for initial scripted loaders and C2 communication. A first agent evaluates these early infection leads. The hunt then examines high-frequency scheduled tasks and registry entries used to suppress legitimate clients. An agent synthesizes the early leads with the persistence evidence to confirm if a host has been successfully hijacked and is being used for further propagation. Finally, an analyst confirms the findings and isolates the affected endpoints.

## scoping-screenconnect
<!-- Scope ScreenConnect hosts -->
Identify hosts running ScreenConnect that are potentially vulnerable to the RMM+ extension exploit.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hosts running ScreenConnect. Silence means the software inventory
  is either not collected or the product is absent.
reads:
- device_hostname
- package_name
- package_version
- vendor_name
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%screenconnect%'
```

## parallel-early-leads
<!-- Early infection leads -->
parallel:
- → loader-process-activity
- → c2-dns-activity
join: → early-stage-triage

## loader-process-activity
<!-- Loader process activity -->
Find executions of the Stage0Loader or subsequent stagers through command-line analysis.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, loader_indicators=loader_indicators, scope_hosts=scope_hosts)
~~~yaml
expected: PowerShell or CMD lines fetching payloads from the mo7sen.dev domain or
  running the named loader scripts.
reads:
- device_hostname
- process_name
- process_cmd_line
- user_name
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%eadf.php%' OR LOWER(process_cmd_line) LIKE '%sckit%' OR instr(',' || '{{loader_indicators}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## c2-dns-activity
<!-- DNS activity to stager domains -->
Corroborate process leads by checking for host resolutions to the attacker infrastructure.

```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, c2_domains=c2_domains, scope_hosts=scope_hosts)
~~~yaml
expected: Any resolution of the named domains. Silence means the domains have rotated
  or no communication occurred within the lookback.
reads:
- device_hostname
- query_hostname
- time
silence: not_evidence_of_absence
source: hb_dns_activity
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, query_hostname, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, query_hostname
```

## early-stage-triage
<!-- Early stage triage -->
```agent target=hunter
cite: required
context:
- loader-process-activity
- c2-dns-activity
max_iterations: 3
objective: Identify hosts where the combination of loader process activity and C2
  DNS resolution indicates an active SCKit infection.
success_criteria: A per-host verdict on early-stage infection, citing command lines
  and domains.
tools:
- endpoint
```

## parallel-persistence-leads
<!-- Persistence leads -->
parallel:
- → persistence-task-trapwatch
- → persistence-registry-activity
join: → follow-on-triage

## persistence-task-trapwatch
<!-- Persistence via TrapWatch task -->
Find the high-frequency TrapWatch task that hijacks the ScreenConnect relay slot every 10 seconds.

```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: A task named TrapWatch running as SYSTEM. Prevalence should be low (rare)
  across the fleet.
prevalence:
  by: device_hostname
  key:
  - job_name
  rare_below: 3
reads:
- device_hostname
- job_name
- job_cmd_line
- job_user_name
- time
silence: evidence_of_absence
source: hb_scheduled_job
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_name) = 'trapwatch' OR LOWER(job_cmd_line) LIKE '%trapwatch.ps1%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## persistence-registry-activity
<!-- Persistence via RelayTrap Run key -->
Identify the RelayTrapLiteAlert run key used to launch the alerting script at user logon.

```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Registry set events pointing to Lite-Alert.ps1 in C:\ProgramData\RelayTrap.
reads:
- device_hostname
- reg_target
- reg_value_data
- time
silence: not_evidence_of_absence
source: hb_registry_activity
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE (LOWER(reg_target) LIKE '%relaytraplitealert%' OR LOWER(reg_value_data) LIKE '%lite-alert.ps1%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## follow-on-triage
<!-- Follow-on triage -->
```agent target=hunter
cite: required
context:
- early-stage-triage
- persistence-task-trapwatch
- persistence-registry-activity
max_iterations: 3
objective: Incorporate the early infection verdict with the persistence mechanisms
  found. Determine if the host is actively hijacked by SCKit.
success_criteria: A final verdict of malicious | suspicious | benign per host, citing
  the full infection-to-hijack chain.
tools:
- endpoint
```

## route-on-verdict
<!-- Route on verdict -->
if~: "the follow-on-triage verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: missing-endpoint-telemetry)
else: → close-out

## isolate-host
<!-- Isolate host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host from the network immediately. Do not kill the ScreenConnect processes until memory captures are performed, as SCKit may be residing in the legitimate process context.
```
→ analyst-review

## analyst-review
<!-- Analyst review -->
```manual target=analyst
Examine the ProgramData\RelayTrap directory. Review the Task Scheduler for any tasks created in the last 48 hours. Confirm if the host's ScreenConnect client was actively suppressed.
```
→ close-out

## close-out
<!-- Close out -->
```manual target=analyst
Record the total number of infected and isolated hosts. Update the detection rule candidate 'loader-process-activity' with any new filenames discovered.
```
→ end