Detect ConnectWise ScreenConnect Improper Privilege Management & Missing Authorization (CVE-2026-84869) in CrowdStrike LogScale
Detects exploitation of CVE-2026-84869, a KEV-listed improper privilege management (CWE-269) and missing authorization (CWE-862) vulnerability in ConnectWise ScreenConnect. Attackers abuse insufficient authorization checks on administrative/management endpoints to escalate privileges, create rogue administrative users, modify session-group permissions, or invoke privileged operations (remote command execution, extension upload) without proper authorization. Detection focuses on anomalous ScreenConnect web/service activity: unauthenticated or low-privilege access to admin API paths, privilege/role changes, new administrator provisioning, and remote command dispatch from the ScreenConnect service host.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=/^(HttpRequest|NetworkConnect)/ OR (#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ ParentBaseFileName="ScreenConnect.Service.exe")
| case {
ParentBaseFileName="ScreenConnect.Service.exe" ImageFileName=/(cmd|powershell|pwsh|wscript|cscript)\.exe$/i | ChildSpawn := 1 ;
* | ChildSpawn := 0 ;
}
| groupBy([aid, ComputerName], function=([count(as=events), collect([ImageFileName, CommandLine, ParentBaseFileName])]))
| ChildSpawn = 1CrowdStrike CQL detecting suspicious child processes (shells/scripting hosts) spawned by the ScreenConnect service, indicating post-authorization-bypass remote command execution.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate remote command execution by authorized ScreenConnect sessions
- Patch and software deployment scripts run through ScreenConnect
- Administrator maintenance tasks executed remotely
Other platforms for CVE-2026-84869
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated unauthorized POST to ScreenConnect security service endpoint
Expected signal: IIS W3CIISLog entry with csMethod=POST, csUriStem=/Services/SecurityService.ashx, scStatus=200/302
- Test 2Scripted admin endpoint access with non-browser user agent
Expected signal: Web/IIS log showing POST to /Administration with user agent python-requests
- Test 3ScreenConnect service spawning a command shell
Expected signal: ProcessRollup2/Sysmon EventID 1 with ParentImage ScreenConnect.Service.exe and child cmd.exe
References (4)
- https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-84869
Response Playbook
Triage
- Confirm the ScreenConnect server version against the ConnectWise 2026-09-08 security bulletin to determine if the host is unpatched and exposed to CVE-2026-84869.
- Review IIS/web logs for the flagged source IP: enumerate all POST requests to /Services/SecurityService.ashx, /Services/AuthenticationService.ashx, /Administration and /App_Extensions/ and correlate with authenticated session identity.
- Inspect the ScreenConnect user store and audit log for newly created administrator accounts, unexpected role/permission changes, or session-group role modifications occurring near the suspicious requests.
- Determine whether the source IP is an expected administrator/MSP address or an untrusted external host.
Containment
- Isolate or take the ScreenConnect server offline from external access (block inbound to the management port at the firewall) until patched.
- Disable or delete any unauthorized administrator accounts and revoke active sessions and API tokens.
- Apply the ConnectWise fixed version from the 2026-09-08 bulletin and force credential rotation for all ScreenConnect admin accounts.
Evidence Collection
- Preserve IIS W3C logs, ScreenConnect application/audit logs (App_Data), and the user/role configuration database for the affected time window.
- Capture endpoint process telemetry for children of ScreenConnect.Service.exe and any uploaded extensions under App_Extensions/ for forensic analysis.
Escalation Criteria
- !Escalate to incident response if an unauthorized administrator account was created or a shell/scripting process was spawned by the ScreenConnect service.
- !Escalate if evidence shows remote command execution against managed endpoints or lateral movement stemming from the ScreenConnect host.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS W3C access logs showing POSTs to ScreenConnect security/administration endpoints - >
ScreenConnect audit logs and user/role database entries under App_Data - >
Uploaded extension files under the App_Extensions/ directory - >
Child process creation records where ParentBaseFileName is ScreenConnect.Service.exe
Tuning Guidance
Build an allowlist of known administrator/MSP source IP ranges and expected automation user agents, then filter those from the detection. Focus alerting on POST activity from external or first-seen IPs, non-browser user agents, and requests immediately followed by new-account creation or ScreenConnect.Service.exe spawning shell processes. If your organization does not expose ScreenConnect to the internet, tighten thresholds and treat any external hit as high fidelity.
Hunting Queries
Baseline all administrative endpoint POST activity to identify anomalous source IPs and scripted user agents interacting with ScreenConnect privileged services.
W3CIISLog | where csUriStem has_any ("SecurityService.ashx","AuthenticationService.ashx","/Administration","/App_Extensions/") | where csMethod == "POST" | summarize count() by cIP, csUriStem, cUserAgent, bin(TimeGenerated,1h)index=web sourcetype IN ("iis","ms:iis:auto") http_method=POST uri_path IN ("/Services/SecurityService.ashx","/Services/AuthenticationService.ashx","/Administration") | stats count by src_ip, uri_path, useragentAtomic Red Team Tests
Sends an unauthenticated POST to the ScreenConnect SecurityService endpoint to generate IIS telemetry matching the detection (lab server only).
Command
powershell -c "Invoke-WebRequest -Uri 'https://sc-lab.local/Services/SecurityService.ashx' -Method POST -Body 'CreateUser=attacker&role=Administrator' -UseBasicParsing"Cleanup
powershell -c "Remove-Item -Path 'C:\\Program Files (x86)\\ScreenConnect\\App_Data\\testuser.tmp' -ErrorAction SilentlyContinue"Expected Telemetry
IIS W3CIISLog entry with csMethod=POST, csUriStem=/Services/SecurityService.ashx, scStatus=200/302
Expected Detection
KQL/SPL/AQL/Sumo/Chronicle rules fire on the POST to the privileged endpoint.
Uses curl with a scripted user agent to hit the /Administration endpoint, simulating tooling-driven authorization bypass.
Command
curl -s -X POST -A 'python-requests/2.31' -d 'action=SetRole&user=svc&role=Administrator' https://sc-lab.local/AdministrationCleanup
echo 'no persistent artifact; server-side test account removed via console if created'Expected Telemetry
Web/IIS log showing POST to /Administration with user agent python-requests
Expected Detection
Detection flags non-browser user agent POST to ScreenConnect administrative path.
Simulates post-exploitation remote command execution by having a process that mimics ScreenConnect service spawn cmd.exe (lab endpoint).
Command
powershell -c "Start-Process -FilePath cmd.exe -ArgumentList '/c whoami'"Cleanup
echo 'no cleanup required; transient process'Expected Telemetry
ProcessRollup2/Sysmon EventID 1 with ParentImage ScreenConnect.Service.exe and child cmd.exe
Expected Detection
CrowdStrike CQL and Elastic EQL sequence rules detect the privileged child process spawn.