Event ID 200 — Executed command of length.

Provider: ScreenConnect
Channel: Application

Description

Executed command of length.

Message #

Executed command of length

Fields #

Name	Description
`Data` UnicodeString	—

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

Remote Access Tool - ScreenConnect Command Execution source low: Detects command execution via ScreenConnect RMM

References #

Hunt & Hackett https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling
RULER Project https://ruler-project.github.io/ruler-project/RULER/remote/Connectwise_Screenconnect