feat: add Newly Observed ScreenConnect Host Server rule under Command & Control

Parses the &h= relay host from ScreenConnect.ClientService.exe command
lines via extract_matches and surfaces relays not pointing at the
official screenconnect.com / connectwisecontrol.com cloud, scoped to a
single endpoint. Mirrors the Elastic ESQL rule for newly observed
self-hosted ScreenConnect servers (T1219.002).

Author: LasCC

s1_powerquery_hunting.json

@@ -149,6 +149,11 @@
         "name": "Screenconnect Remote Execution",
         "query": "(src.process.parent.name = 'ScreenConnect.ClientService.exe' AND src.process.name in ('powershell.exe', 'cmd.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
     },
+    {
+        "category": "Command & Control",
+        "name": "Newly Observed ScreenConnect Host Server",
+        "query": "(src.process.name = \"ScreenConnect.ClientService.exe\" OR src.process.publisher contains:anycase \"ConnectWise\") AND src.process.cmdline contains:anycase \"&h=\"\n| let screenconnectServer = src.process.cmdline.extract_matches('[?&]h=([^&\"]+)').get(0)\n| filter screenconnectServer != null\n| filter NOT (screenconnectServer contains:anycase \".screenconnect.com\" OR screenconnectServer contains:anycase \".connectwisecontrol.com\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), EndpointCount=estimate_distinct(endpoint.name), UniqueHosts=array_agg_distinct(endpoint.name), UniqueUsers=array_agg_distinct(src.process.user), UniqueParents=array_agg_distinct(src.process.parent.name), UniqueCmdlines=array_agg_distinct(src.process.cmdline) by screenconnectServer\n| filter EndpointCount == 1\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllHosts = UniqueHosts.to_string(', '), AllUsers = UniqueUsers.to_string(', '), AllParents = UniqueParents.to_string(', '), AllCmdlines = UniqueCmdlines.to_string(' | ')\n| columns \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, screenconnectServer, EndpointCount, AllHosts, AllUsers, AllParents, AllCmdlines, Count\n| sort -_FirstSeenMs\n| limit 100000"
+    },
     {
         "category": "Execution & TTPs",
         "name": "NetExec RDP Behaviour detected",