Process Monitor

Reported Context (2)

should enable Fusion logging to capture detailed assembly resolution activity and use tools like Process Monitor to observe file access patterns and identify when malicious assemblies are being loaded. How App Domain Manager Injection Abuses Trusted .NET Applications—and How to Detect It
this User.xml file will be modified any time any user performs any activity. This was verified via Process Monitor that this User.xml file was overwritten after each successful attempt. This makes definitive Huntress Shares Detection Guidance for ConnectWise ScreenConnect Authentication Bypass

CVE (1)

People (7)

MITRE ATT&CK (5)

Vendors (3)

Products (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.