Connectwise | infosecpwn

Rogue ScreenConnect clients: hunt the session, not the filenames

Modified ScreenConnect clients that infect every host they connect to. The durable detection is in the audit log.