Huntress Traces MSSQL-Based Attempts to Install ScreenConnect
Summary
Huntress traced automated-looking commands from MSSQL processes on two endpoints to attempted ScreenConnect installations. Investigators found no evidence the installers succeeded.
Key points
- Huntress investigated alerts involving three Fortinet Enterprise Management Server endpoints and built timelines for two using Windows Event Logs and EDR telemetry.
- On both examined endpoints, MSSQL activity included an xp_cmdshell invocation and a finger.exe command targeting 185.56.83.82.
- Later commands used character-to-decimal encoding and attempted to run MSI installers; investigators found no evidence that the downloads or installations succeeded.
- PowerShell commands from the SQL Server process attempted to download a ScreenConnect installer from 95.179.241.10.
- Huntress obtained a copy of an installer and found it was configured to connect to 95.179.241.10; no successful ScreenConnect installation was observed.
- Similar command sequences and timing across the two endpoints suggested the activity may have followed an automated script or playbook.
Article Details
- Attack Vectors
- MSSQL's xp_cmdshell was used to launch commands from the sqlservr.exe process.
- PowerShell download cradles attempted to retrieve and install a ConnectWise ScreenConnect MSI from 95.179.241[.]10:23963.
- The activity included decimal-encoded commands and obfuscated PowerShell strings.
- msiexec commands attempted to install MSI files from the Windows temporary directory.
- Defensive Notes
- Huntress analysts found no indication that the ScreenConnect MSI installation succeeded on either investigated endpoint.
- Review MSSQL and Windows Event Logs alongside EDR telemetry for unexpected xp_cmdshell activity, child processes from sqlservr.exe, and MSI installation attempts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 185[.]56[.]83[.]82 | Identified by Huntress as the initial “C2” IP address targeted by a finger command. |
| IPV4 | 95[.]179[.]241[.]10 | Source IP used to host the ScreenConnect installer download; the recovered instance also attempted to connect to this IP. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationCommands were encoded by converting characters to decimal values separated by “+”; the PowerShell download command also split and mixed the characters of its method name.T1059.001 · PowerShellPowerShell commands launched download cradles to retrieve the ScreenConnect installer.T1059.003 · Windows Command ShellWindows command shell commands invoked finger.exe and PowerShell, and launched msiexec.T1218.007 · MsiexecCommands used msiexec to attempt installation of MSI files from the Windows temporary directory.T1219 · Remote Access ToolsThe attempted installer was a ConnectWise ScreenConnect instance intended to provide remote access; analysts found no indication it was successfully installed.
Products
Fortinet EMSpackage installation. A recent series of incidents across three endpoints running the Fortinet Enterprise Management Server (EMS) system were initiated by alerts as illustrated in Figure 1.MSSQL Expressanalysts continue to see alerts indicating malicious activity on endpoints running MSSQL Server or MSSQL Express, either as stand-alone installations, or as part of a larger application package installation. AMSSQL ServerHuntress SOC analysts continue to see alerts indicating malicious activity on endpoints running MSSQL Server or MSSQL Express, either as stand-alone installations, or as part of a larger application packageScreenConnectHomeBlogMSSQL to ScreenConnect