Overview
ConnectWise ScreenConnect is a legitimate remote monitoring and management platform widely used by IT departments, managed service providers and support teams. Yet ScreenConnect regularly appears in antivirus, EDR and security alerts, sometimes creating the impression that the application itself is malicious. The reality is more nuanced. ScreenConnect provides many of the same capabilities attackers need after compromising a system. Remote control, unattended access, command execution, file transfer and persistent connectivity are valuable administration features—but they can also become powerful attack tools when deployed without authorisation.
Legitimate Administration Looks Similar to Attacker Behaviour
ScreenConnect is designed to provide administrators with deep remote access to managed systems. That may include installing a persistent service, establishing outbound communications, transferring files, executing commands and remotely controlling devices. From an endpoint security perspective, these behaviours overlap closely with techniques associated with remote-access trojans and command-and-control activity. Security platforms therefore cannot always determine whether ScreenConnect is being used by an authorised technician or an attacker simply by looking at the executable. Context becomes more important than the application name.
Why Attackers Use Legitimate RMM Tools
Threat actors increasingly use legitimate remote-management software because it provides ready-made functionality without requiring custom malware. Microsoft has documented multiple campaigns where attackers deployed ScreenConnect after gaining access to environments, using it for persistent remote access, command execution and lateral movement. Ransomware groups and initial-access actors have also been observed using legitimate RMM platforms to remain connected to compromised systems.This creates a significant detection challenge because malicious activity can operate through software that may already be trusted within an organisation.
A Detection Does Not Always Mean Malware
When ScreenConnect is flagged, the classification matters. An alert identifying RemoteAdmin, RMM, potentially unwanted software or suspicious ScreenConnect behaviour does not necessarily mean the installed application is infected. It may instead indicate that the security platform has detected software capable of providing remote administrative control. More serious alerts may be triggered when ScreenConnect appears unexpectedly, is installed from an unfamiliar server, executes unusual PowerShell commands, creates suspicious services or appears alongside credential theft, security-control changes or other malicious behaviour. The correct response is therefore not automatically to remove ScreenConnect, but to determine whether the instance is authorised and behaving as expected.
Managing ScreenConnect as Privileged Infrastructure
Remote-management software should be governed as privileged infrastructure rather than treated as an ordinary desktop application. Approved ScreenConnect instances should be clearly documented and identifiable, with strong authentication, MFA, role-based permissions and restricted administrative access. Software versions should remain current, particularly because ConnectWise continues to release security updates and hardening improvements for the platform. Application control can also prevent unauthorised RMM installations while allowing approved corporate instances. Centralised logging should provide visibility into technician sessions, remote commands, file transfers and unexpected agent installations.
Expert in the Cloud Insight
ScreenConnect is frequently flagged not because it is inherently malicious, but because its legitimate capabilities are extremely valuable to attackers. This creates an important distinction in modern security architecture:
Trusted software does not automatically mean trusted activity.
The question should not simply be whether ScreenConnect exists within an environment. It should be whether the organisation knows which ScreenConnect instance is installed, who controls it, how it arrived and what it is doing. Removing every RMM alert creates operational disruption. Ignoring every RMM alert creates security risk. The stronger approach is governance: establish approved remote-management platforms, restrict alternatives and monitor their behaviour continuously.
Remote access should be trusted because it is controlled—not simply because the software is legitimate.
Leave a Reply