High Severity

Link: ScreenConnect remote access tool delivery with unattended guest access

Labels

Description

Detects inbound messages containing ScreenConnect links that direct recipients to download a Guest Access installer (.msi or .exe). The links use ScreenConnect's integration parameters specifying Guest session type and Access mode, indicating unsolicited remote access tool deployment. Lures observed include fake invoices, payment proofs, event invitations, and social gathering notifications — often urging recipients to open the link on a Windows desktop and install the downloaded file.

References

No references.

Sublime Security

Created Jul 21st, 2026 • Last updated Jul 21st, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
// at least one link to screenconnect
and length(filter(body.links,
                  .href_url.domain.root_domain == "screenconnect.com"
                  // exclude tenant_domains (if the customer users screenconnect and has their own subdomain)
                  and .href_url.domain.domain not in $tenant_domains
           )
) > 0
// all the screenconnect links include an msi/exe with Guesst Access
and all(filter(body.links, .href_url.domain.root_domain == "screenconnect.com"),
        strings.iends_with(.href_url.path, '.msi', '.exe')
        // https://docs.connectwise.com/ScreenConnect_Documentation/Developers/Integration_guide
        // e = SessionType. Support, Meet, or Access
        and strings.icontains(.href_url.query_params, "e=Access")
        // y = ProcessType (host vs guest)
        and strings.icontains(.href_url.query_params, "y=Guest")
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.