{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "SCKit is an aggressive worm specifically designed to hijack remote management sessions. A successful infection compromises the organization's primary IT management channel, allowing an attacker to push malicious code across the entire fleet via the technician's workstation." }, "name": "SCKit Endpoint Hijacking and Persistence", "type": "investigation", "labels": [ "hunt", "attack.t1053.005", "attack.t1059.001", "attack.t1190", "attack.t1547.001", "credential access", "execution", "initial access", "lateral movement", "persistence" ], "series": { "slug": "sckit-worm-installs-rogue-screenconnect-clients-and-session-cookie-relays-across-hundreds-of-end", "index": 1, "title": "SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints", "total": 2 }, "related": [ { "hunt": "sckit-cookie-theft-lateral-propagation", "reason": "This hunt focuses on the endpoint hijack; the subsequent lateral propagation through stolen session cookies is covered in the next hunt in this series.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule would fire on the TrapWatch task name, but SCKit rotates its indicators. This hunt uses a phased approach, correlating the presence of ScreenConnect with loader behaviour and high-frequency persistence, providing the context an analyst needs to distinguish a malicious hijack from a technician's legitimate automation.", "coverage": [ { "stage": "rmm-plus-extension-exploitation", "reason": "The blank access key is sent in the POST body, which is not captured by hb_http_activity.", "status": "not_visible", "blind_spot": "http-post-body-blindness" }, { "stage": "scripted-loader-execution", "steps": [ "loader-process-activity", "c2-dns-activity" ], "status": "covered" }, { "stage": "trapwatch-task-persistence", "steps": [ "persistence-task-trapwatch" ], "status": "covered" }, { "stage": "registry-run-persistence", "steps": [ "persistence-registry-activity" ], "status": "covered" }, { "stage": "session-cookie-harvesting", "reason": "Belongs to another part of the 'SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints' series.", "status": "out_of_scope" }, { "stage": "lateral-toolbox-propagation", "reason": "Belongs to another part of the 'SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "RMM+ Extension Authentication Bypass", "slug": "rmm-plus-extension-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "POST requests to ScreenConnect servers with blank RMMPlus.AccessKey", "RMM+ versions 1.0.31 and 1.0.32" ] }, { "name": "Scripted Loader and Payload Delivery", "slug": "scripted-loader-execution", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "Stage0Loader.ps1", "Run-Lateral-Full.bat", "sckit-loader.ps1", "ns.mo7sen.dev/EadF.php?p=1", "%TEMP%\\k.ps1", "cdn007-digitaldownloads.com" ] }, { "name": "High-Frequency Scheduled Task Persistence", "slug": "trapwatch-task-persistence", "tactic": "persistence", "techniques": [ "T1053.005" ], "observables": [ "Task name: TrapWatch", "Command: TrapWatch.ps1", "Frequency: Every 10 seconds", "Runs as SYSTEM" ] }, { "name": "Registry Run Key Persistence", "slug": "registry-run-persistence", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "Run key name: RelayTrapLiteAlert", "Command: Lite-Alert.ps1", "C:\\ProgramData\\RelayTrap" ] }, { "name": "Technician Session Cookie Theft", "slug": "session-cookie-harvesting", "tactic": "credential-access", "techniques": [ "T1059.001" ], "observables": [ "sqlite3.exe reading browser cookie databases", "Panel-Lateral.ps1", "LabConfig.ps1", "ns.mo7sen.dev/EadF.php?p=5" ] }, { "name": "Shared Toolbox Lateral Propagation", "slug": "lateral-toolbox-propagation", "tactic": "lateral-movement", "techniques": [ "T1059.001" ], "observables": [ "ToolboxRelayUploader.exe using stolen tokens", "AddToToolbox command on ScreenConnect panels", "sc.payproofkit.com", "185.99.255.28", "155.94.150.39" ] } ], "summary": "Attackers exploit an authentication flaw in the third-party RMM+ extension for ScreenConnect to push commands to managed endpoints. The resulting SCKit worm establishes persistence via high-frequency scheduled tasks and registry keys, hijacks legitimate client connections, and steals technician session cookies to propagate laterally through the ScreenConnect shared toolbox." }, "severity": "high", "rationale": "Target hosts where ScreenConnect is installed. If the software inventory is large, prioritize servers and workstations belonging to IT technicians, as they are the primary conduits for SCKit's lateral propagation.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has exploited vulnerable ScreenConnect extensions to deploy the SCKit toolkit, which hijacks legitimate management sessions through aggressive scheduled tasks and registry persistence.", "parameters": { "c2_domains": { "from": { "ref": "huntress-sckit-worm", "kind": "article", "observed": "2026-11-12" }, "type": "list[domain]", "default": [ "ns.mo7sen.dev", "cdn007-digitaldownloads.com", "relaytrap.cs", "newnewnew.gotdns.org", "sc.payproofkit.com", "soxnewwork.homedns.org" ], "description": "C2 and staging domains named in the report." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Hosts identified with ScreenConnect; leave empty to run against the whole estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "loader_indicators": { "from": { "ref": "huntress-sckit-worm", "kind": "article", "observed": "2026-11-12" }, "type": "list[string]", "default": [ "Stage0Loader.ps1", "sckit-loader.ps1", "Run-Lateral-Full.bat", "sckit-decoder.ps1", "TrapWatch.ps1", "Lite-Alert.ps1" ], "description": "Filenames and strings associated with the SCKit infection chain." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/sckit-worm-rogue-screenconnect", "name": "Huntress \u2014 SCKit Worm Installs Rogue ScreenConnect Clients" } ], "blind_spots": [ { "id": "missing-endpoint-telemetry", "risk": "A host without an agent provides no process, task, or registry telemetry, making it a blind spot where SCKit can persist and spread undetected.", "question": "Are there ScreenConnect clients that we cannot observe?", "requires": "an endpoint agent (osquery/sysmon) on every host with ScreenConnect" }, { "id": "http-post-body-blindness", "risk": "Standard HTTP telemetry does not capture the POST body; exploitation of the RMM+ extension is inferred from the subsequent loader activity rather than directly observed.", "stage": "rmm-plus-extension-exploitation", "question": "Can we see the blank RMMPlus.AccessKey in the POST request?", "requires": "hb_http_activity with POST body content" } ] }, "name": "SCKit Endpoint Hijacking and Persistence", "description": "An adversary exploits vulnerable ScreenConnect extensions to deploy the SCKit toolkit, which hijacks legitimate management sessions through aggressive scheduled tasks and registry persistence. This hunt identifies the ScreenConnect estate and then searches for initial scripted loaders and C2 communication. A first agent evaluates these early infection leads. The hunt then examines high-frequency scheduled tasks and registry entries used to suppress legitimate clients. An agent synthesizes the early leads with the persistence evidence to confirm if a host has been successfully hijacked and is being used for further propagation. Finally, an analyst confirms the findings and isolates the affected endpoints." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "sckit-worm-installs-rogue-screenconnect-clients-and-session-cookie-relays-across-hundreds-of-end", "index": 1, "title": "SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints", "total": 2 }, "coverage": [ { "stage": "rmm-plus-extension-exploitation", "reason": "The blank access key is sent in the POST body, which is not captured by hb_http_activity.", "status": "not_visible", "blind_spot": "http-post-body-blindness" }, { "stage": "scripted-loader-execution", "steps": [ "loader-process-activity", "c2-dns-activity" ], "status": "covered" }, { "stage": "trapwatch-task-persistence", "steps": [ "persistence-task-trapwatch" ], "status": "covered" }, { "stage": "registry-run-persistence", "steps": [ "persistence-registry-activity" ], "status": "covered" }, { "stage": "session-cookie-harvesting", "reason": "Belongs to another part of the 'SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints' series.", "status": "out_of_scope" }, { "stage": "lateral-toolbox-propagation", "reason": "Belongs to another part of the 'SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints' series.", "status": "out_of_scope" } ], "rationale": "An intruder has exploited vulnerable ScreenConnect extensions to deploy the SCKit toolkit, which hijacks legitimate management sessions through aggressive scheduled tasks and registry persistence.", "blind_spots": [ { "id": "missing-endpoint-telemetry", "risk": "A host without an agent provides no process, task, or registry telemetry, making it a blind spot where SCKit can persist and spread undetected.", "question": "Are there ScreenConnect clients that we cannot observe?", "requires": "an endpoint agent (osquery/sysmon) on every host with ScreenConnect" }, { "id": "http-post-body-blindness", "risk": "Standard HTTP telemetry does not capture the POST body; exploitation of the RMM+ extension is inferred from the subsequent loader activity rather than directly observed.", "stage": "rmm-plus-extension-exploitation", "question": "Can we see the blank RMMPlus.AccessKey in the POST request?", "requires": "hb_http_activity with POST body content" } ], "scoping_notes": "Target hosts where ScreenConnect is installed. If the software inventory is large, prioritize servers and workstations belonging to IT technicians, as they are the primary conduits for SCKit's lateral propagation.", "beyond_detection": "A single detection rule would fire on the TrapWatch task name, but SCKit rotates its indicators. This hunt uses a phased approach, correlating the presence of ScreenConnect with loader behaviour and high-frequency persistence, providing the context an analyst needs to distinguish a malicious hijack from a technician's legitimate automation." } }, { "id": "scoping-screenconnect", "type": "query", "label": "Scope ScreenConnect hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%screenconnect%'", "surface": "hb_software_inventory", "description": "Identify hosts running ScreenConnect that are potentially vulnerable to the RMM+ extension exploit.", "expected_signal": "A list of hosts running ScreenConnect. Silence means the software inventory is either not collected or the product is absent." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope ScreenConnect hosts", "reads": [ "device_hostname", "package_name", "package_version", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%screenconnect%'", "silence": "not_evidence_of_absence", "expected": "A list of hosts running ScreenConnect. Silence means the software inventory is either not collected or the product is absent.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "loader-process-activity", "type": "query", "label": "Loader process activity", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%eadf.php%' OR LOWER(process_cmd_line) LIKE '%sckit%' OR instr(',' || '{{loader_indicators}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_process_activity", "description": "Find executions of the Stage0Loader or subsequent stagers through command-line analysis.", "expected_signal": "PowerShell or CMD lines fetching payloads from the mo7sen.dev domain or running the named loader scripts." }, "parents": [ { "id": "scoping-screenconnect" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Loader process activity", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%eadf.php%' OR LOWER(process_cmd_line) LIKE '%sckit%' OR instr(',' || '{{loader_indicators}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "PowerShell or CMD lines fetching payloads from the mo7sen.dev domain or running the named loader scripts.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "c2-dns-activity", "type": "query", "label": "DNS activity to stager domains", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, query_hostname", "surface": "hb_dns_activity", "description": "Corroborate process leads by checking for host resolutions to the attacker infrastructure.", "expected_signal": "Any resolution of the named domains. Silence means the domains have rotated or no communication occurred within the lookback." }, "parents": [ { "id": "scoping-screenconnect" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS activity to stager domains", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, query_hostname", "silence": "not_evidence_of_absence", "expected": "Any resolution of the named domains. Silence means the domains have rotated or no communication occurred within the lookback.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Early stage triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "loader-process-activity", "c2-dns-activity" ], "objective": "Identify hosts where the combination of loader process activity and C2 DNS resolution indicates an active SCKit infection.", "description": "Assess whether the initial infection leads are substantive enough to warrant deep persistence hunting.", "max_iterations": 3, "expected_signal": "A list of hosts showing strong signs of SCKit stager execution.", "success_criteria": "A per-host verdict on early-stage infection, citing command lines and domains." }, "parents": [ { "id": "loader-process-activity", "kind": "merge" }, { "id": "c2-dns-activity", "kind": "merge" } ] }, { "id": "persistence-task-trapwatch", "type": "query", "label": "Persistence via TrapWatch task", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_name) = 'trapwatch' OR LOWER(job_cmd_line) LIKE '%trapwatch.ps1%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_scheduled_job", "description": "Find the high-frequency TrapWatch task that hijacks the ScreenConnect relay slot every 10 seconds.", "expected_signal": "A task named TrapWatch running as SYSTEM. Prevalence should be low (rare) across the fleet." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Persistence via TrapWatch task", "reads": [ "device_hostname", "job_name", "job_cmd_line", "job_user_name", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_name) = 'trapwatch' OR LOWER(job_cmd_line) LIKE '%trapwatch.ps1%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A task named TrapWatch running as SYSTEM. Prevalence should be low (rare) across the fleet.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "job_name" ], "rare_below": 3 }, "verified_at": "2026-11-13" } }, { "id": "persistence-registry-activity", "type": "query", "label": "Persistence via RelayTrap Run key", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE (LOWER(reg_target) LIKE '%relaytraplitealert%' OR LOWER(reg_value_data) LIKE '%lite-alert.ps1%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_registry_activity", "description": "Identify the RelayTrapLiteAlert run key used to launch the alerting script at user logon.", "expected_signal": "Registry set events pointing to Lite-Alert.ps1 in C:\\ProgramData\\RelayTrap." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Persistence via RelayTrap Run key", "reads": [ "device_hostname", "reg_target", "reg_value_data", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE (LOWER(reg_target) LIKE '%relaytraplitealert%' OR LOWER(reg_value_data) LIKE '%lite-alert.ps1%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Registry set events pointing to Lite-Alert.ps1 in C:\\ProgramData\\RelayTrap.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "follow-on-triage", "type": "analytic", "label": "Follow-on triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-triage", "persistence-task-trapwatch", "persistence-registry-activity" ], "objective": "Incorporate the early infection verdict with the persistence mechanisms found. Determine if the host is actively hijacked by SCKit.", "description": "Synthesize the early infection findings with the confirmed persistence to reach a final verdict.", "max_iterations": 3, "expected_signal": "Final verdicts confirming hijacked ScreenConnect clients.", "success_criteria": "A final verdict of malicious | suspicious | benign per host, citing the full infection-to-hijack chain." }, "parents": [ { "id": "persistence-task-trapwatch", "kind": "merge" }, { "id": "persistence-registry-activity", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the follow-on-triage verdict is malicious for at least one host", "condition": "the follow-on-triage verdict is malicious for at least one host", "blind_spot": "missing-endpoint-telemetry", "confidence": "high", "description": "Direct the response based on the agent's synthesized verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "follow-on-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Stop the worm's local activity and prevent further session hijacking by isolating the host.", "instructions": "Isolate the host from the network immediately. Do not kill the ScreenConnect processes until memory captures are performed, as SCKit may be residing in the legitimate process context.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Review the forensic evidence and plan for remediation.", "instructions": "Examine the ProgramData\\RelayTrap directory. Review the Task Scheduler for any tasks created in the last 48 hours. Confirm if the host's ScreenConnect client was actively suppressed." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document results and close the hunt.", "instructions": "Record the total number of infected and isolated hosts. Update the detection rule candidate 'loader-process-activity' with any new filenames discovered." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }