Weird host showed up on my ScreenConnect unattended access list

Posted by DeejayCa@reddit | sysadmin | View on Reddit | 8 comments

Something weird (and I ended up opening a ticket with ConnectWise) but has anyone had a ScreenConnect host just randomly show up in your account list? It's not associated to any company or anything that I deal with, so not sure how it was installed. Is it possible some random bot had grabbed a URL of my ScreenConnect cloud instance and just ran the installer? I checked the IP and it's listed in Span, and associated with Panda Security ISP, could it be a WatchGuard EDR Core or APT sandbox environment that ran the file? Funny how they would use a Windows 7 system with a user name "goatuser". I don't understand the point. Screenshot: https://i.imgur.com/Sp3B6Vr.png What are your thoughts?

Reply to Post

8 Comments

[-]

Sunsparc@reddit

I have one of these too called ABBY-PC. The IP address shows up as a Microsoft datacenter IP in Des Moines, Iowa. HP Elite running Windows 7, Xeion E5-2673 v4 single core 1GB RAM.

[-]

pointlessone@reddit

Just went through a demo of Connect Wise's Automate, I'm pretty sure that's one of their dummy machines for demos. I think there was an ABBY-PC show up there as well.

[-]

DeejayCa@reddit (OP)

wtf lol

[-]

FariousNetSolutions@reddit

Are you automatically pushing out ConnectWise through Intune, Group Policy or your RMM? I've seen where some security software will run an installer in a sandbox to test for malicious behavior, and can create entries like this.

[-]

DeejayCa@reddit (OP)

Nah, wasn't pushing out the agent that way. There was though an update to the ScreenConnect client that I forced to all endpoints through the ConnectWise ScreenConnect page, I wonder if maybe a sandbox function just picked it up and analyzed it. It was weird because it ignored the parameters of the ScreenConnect installer and just took the base URL which would explain the fact it didn't assign it to a company on my account, but an empty one.

[-]

Weird host showed up on my ScreenConnect unattended access list

Reply to Post

8 Comments

Sunsparc@reddit

pointlessone@reddit

DeejayCa@reddit (OP)

FariousNetSolutions@reddit

DeejayCa@reddit (OP)

FariousNetSolutions@reddit

Prophage7@reddit

tusi2@reddit